Prepare for the CISSP Certified Information Systems Security Professional Exam

Free CISSP Practice Questions (With Answers)

5 real questions from the CISSP bank, with the full explanation for each answer. No sign-up needed to read them.

1. Question 1Identity and Access Management [Credential Attacks]

   An organization implements a 90-day mandatory password rotation policy. A security researcher argues this policy is counterproductive. Which evidence-based argument supports eliminating mandatory rotation?

   • A.Password rotation increases security because new passwords are harder for attackers to guess
   • B.Password rotation is only necessary for privileged accounts — standard user passwords do not need to be rotated
   • C.90-day rotation is too frequent — rotating annually provides the same security with less user friction
   • D.Mandatory rotation drives predictable patterns (Password1!→Password2!) and NIST SP 800-63B now recommends against arbitrary rotation unless compromise is known
   Show answer and explanation

   Correct answer: D

   Correct. NIST SP 800-63B (2017 revision) removed the recommendation for periodic password expiration without evidence of compromise because: forced rotation drives predictable patterns (incrementing numbers, month/year suffixes); users write down passwords more when they change frequently; helpdesk costs increase with rotation overhead; and attackers who obtain a password can often predict the next rotation. NIST now recommends: long, complex passphrases; check against known-breached password lists at creation; and rotate ONLY on known or suspected compromise.

   Why the other options are wrong

   A. Incorrect. This supports rotation, which is what the question asks to argue against. The evidence-based counter-argument is about user behavior in response to forced rotation.

   B. Incorrect. The NIST argument applies broadly — for privileged accounts, PAM with credential vaulting and short-lived credentials is a better control than rotation. This answer partially correct but misses the evidence-based argument for eliminating rotation in favor of breach detection.

   C. Incorrect. This argues for LESS frequent rotation, not eliminating it. The evidence-based argument is that arbitrary rotation (regardless of interval) drives poor password choices. Annual rotation still creates the predictable patterning problem.

2. Question 2First Principles [Exam Strategy]

   A CISSP exam question describes a scenario where a manager wants to implement security controls that exceed regulatory requirements. A junior analyst says this is unnecessary cost. What is the CISSP perspective?

   • A.The analyst is correct — meeting regulatory requirements demonstrates due diligence, and spending beyond that diverts budget from revenue-generating priorities
   • B.The manager is applying risk-based thinking — regulations establish minimums but organizational risk may justify additional controls beyond compliance requirements
   • C.Both are wrong — controls beyond compliance should be adopted only if a quantified cost-benefit analysis proves they reduce insurable losses
   • D.Security controls beyond regulatory requirements should be deferred until competitors adopt them, treating compliance as the prudent baseline for industry-standard spending
   Show answer and explanation

   Correct answer: B

   Correct. CISSP exam perspective on compliance vs. security: Compliance is necessary but not sufficient — meeting regulatory requirements means you've met the minimum floor, not that you're secure; risk-based investment justifies controls beyond regulatory minimums when risk warrants; CISSP rewards: risk-based decision making; understanding that compliance doesn't equal security; implementing controls appropriate to organizational risk appetite, not just regulatory checklists. Exam pattern: when asked to choose between 'meet compliance minimum' and 'address actual risk,' choose the risk-based answer; regulations are typically written to protect minimum standards — actual organizational risk may require more. Example: HIPAA requires 'reasonable and appropriate' safeguards; AES-256 for ePHI might exceed what HIPAA explicitly mandates but is warranted by the sensitivity of the data and the realistic threat landscape.

   Why the other options are wrong

   A. Incorrect. Regulatory minimums establish floors, not ceilings, and due diligence is not the same as adequate security. CISSP consistently rewards answers that go beyond compliance to address actual risk — because compliance doesn't equal security.

   C. Incorrect. Reducing the decision to insurable-loss ROI ignores organizational risk appetite and qualitative risk that may justify controls beyond compliance. Controls must be justified by risk assessment aligned with business objectives, not a narrow financial test alone.

   D. Incorrect. Benchmarking security spend to competitor behavior is not risk-based decision making, and regulations are floors rather than ceilings. Organizations can and should implement controls beyond regulatory minimums when their own risk justifies it, regardless of peer adoption.

3. Question 3Software Development Security [Secure Coding]

   An application uses sequential integer IDs for orders (order?id=1001, 1002, 1003). An authenticated user can view any order by changing the ID parameter, including other users' orders. The team proposes three fixes. Which fix correctly addresses the root vulnerability?

   • A.Switch from sequential integer order IDs to randomly generated UUIDs that cannot be guessed or enumerated
   • B.Add rate limiting on the order endpoint to slow down automated enumeration
   • C.Implement HTTPS with a valid certificate across the entire application to protect order IDs from interception in transit
   • D.Implement an object-level authorization check that verifies the authenticated user owns the requested order before returning it
   Show answer and explanation

   Correct answer: D

   Correct. The vulnerability is Broken Object Level Authorization (BOLA/IDOR) — the application authenticates users but doesn't verify authorization for specific objects. The fix is an authorization check: 'Does this authenticated user own order #1001?' before returning it. This is the only fix that actually prevents unauthorized access.

   Why the other options are wrong

   A. Incorrect. UUIDs make enumeration harder but don't fix the authorization vulnerability. An attacker who obtains a UUID (from a shared link, log exposure, or API response) can still access another user's order if there is no ownership check. Security through obscurity is not authorization.

   B. Incorrect. Rate limiting reduces the speed of automated enumeration but doesn't prevent the access. A determined attacker with valid IDs can still access any order, just more slowly. This is a compensating control at best, not a fix.

   C. Incorrect. HTTPS protects data in transit but has no bearing on authorization. The attack is performed by an authenticated user modifying parameters in their own browser — transport encryption doesn't affect what parameters the user sends.

4. Question 4Identity and Access Management [Authentication]

   A team is evaluating phishing-resistant MFA for 10,000 employees. FIDO2 hardware keys cost $25/user. TOTP authenticator apps are free but not phishing-resistant. The architect proposes a tiered approach: FIDO2 for privileged users (500), and authenticator apps for standard users (9,500). The CISO questions whether TOTP for 9,500 users represents acceptable residual risk. Which analysis best resolves this?

   • A.TOTP for standard users is acceptable — phishing attacks primarily target high-value privileged accounts, and standard users pose limited risk to the organization's core assets and sensitive data
   • B.All users should use FIDO2 — the $237,500 cost is justified because any compromised account can be used for initial access and lateral movement
   • C.The tiered approach is defensible if combined with additional controls: phishing simulation training, anomalous authentication alerting, and conditional access blocking high-risk sign-ins
   • D.TOTP should be replaced with push notification MFA — push notifications represent a highly secure, phishing-resistant authentication method that completely eliminates the need for manual code entry
   Show answer and explanation

   Correct answer: C

   Correct. The tiered approach is a recognized risk-based decision. The residual risk from TOTP (real-time phishing) for standard users is materially reduced by: phishing training (reduces susceptibility), behavioral analytics (detects impossible travel and anomalous authentication), and conditional access (blocks or challenges high-risk sign-ins based on IP reputation, device compliance). The combination provides meaningful mitigation without requiring full FIDO2 deployment cost.

   Why the other options are wrong

   A. Incorrect. Standard user accounts are frequently used as the initial compromise point in APT attacks — a standard user's compromised credentials with TOTP can be phished in real time and used for initial access. The lateral movement to privileged access comes later. Assuming low-privilege users are low-risk ignores the kill chain.

   B. Incorrect. The analysis correctly identifies the risk but ignores cost-effectiveness. At scale, risk-based tiering is standard practice — spending $237,500 to protect 9,500 standard users equally to 500 privileged users may not reflect organizational risk tolerance or be within budget. The argument needs to account for compensating controls.

   D. Incorrect. Push notification MFA (number matching aside) is vulnerable to MFA fatigue attacks — attackers trigger repeated push requests until a user approves one. This is not phishing-resistant. Microsoft and others have added number matching to mitigate this, but standard push without number matching is weaker than TOTP in some respects.

5. Question 5Asset Security [Data Retention and Destruction]

   An organization has employee health records (HIPAA, 6-year retention), financial statements (SOX, 7-year retention), EU customer personal data (GDPR data minimization), and a legal hold on a former employee's records. Which retention approach is MOST defensible?

   • A.Delete EU customer data when its purpose expires per GDPR, retain HIPAA and SOX records per their schedules, and hold all records subject to the legal hold until the hold is released regardless of normal schedule
   • B.Apply the longest retention period (7 years) to all records for simplicity — GDPR's data minimization principle prohibits retaining EU personal data longer than necessary for its purpose, streamlining compliance auditing
   • C.Retain all records for 10 years as a safe buffer beyond all regulatory minimums — retaining data beyond necessary periods creates regulatory risk
   • D.Delete all records after the shortest applicable period to minimize exposure — deleting HIPAA or SOX records before their required retention periods violates those regulations
   Show answer and explanation

   Correct answer: A

   Correct. Each category is governed by its applicable legal framework. Legal holds override all normal retention and destruction schedules — destroying held data is spoliation. GDPR data minimization applies only to EU customer data. HIPAA and SOX schedules govern their respective record types.

   Why the other options are wrong

   B. Incorrect. GDPR's data minimization principle prohibits retaining EU personal data longer than necessary for its purpose. A blanket 7-year rule violates GDPR for EU data. Additionally, legal hold records must be retained beyond any normal schedule until the hold is released.

   C. Incorrect. Retaining data beyond necessary periods creates regulatory risk under GDPR and increases breach exposure. Retention is not a 'longer is safer' decision.

   D. Incorrect. Deleting HIPAA or SOX records before their required periods violates those regulations. Deleting legal hold records constitutes spoliation — a serious legal violation.