ISC CISSP Practice Exams
Last updated on Oct 22,2026- Exam Code: CISSP
- Exam Name: Certified Information Systems Security Professional
- Certification Provider: ISC
- Latest update: Oct 22,2026
With what frequency should monitoring of a control occur when implementing Information Security Continuous Monitoring (ISCM) solutions?
- A . Continuously without exception for all security controls
- B . Before and after each change of the control
- C . At a rate concurrent with the volatility of the security control
- D . Only during system implementation and decommissioning
Which layer of the Open Systems Interconnections (OSI) model implementation adds information concerning the logical connection between the sender and receiver?
- A . Physical
- B . Session
- C . Transport
- D . Data-Link
Which of the following is the PRIMARY risk with using open source software in a commercial software construction?
- A . Lack of software documentation
- B . License agreements requiring release of modified code
- C . Expiration of the license agreement
- D . Costs associated with support of the software
An external attacker has compromised an organization’s network security perimeter and installed a sniffer onto an inside computer .
Which of the following is the MOST effective layer of security the organization could have implemented to mitigate the attacker’s ability to gain further information?
- A . Implement packet filtering on the network firewalls
- B . Require strong authentication for administrators
- C . Install Host Based Intrusion Detection Systems (HIDS)
- D . Implement logical network segmentation at the switches
The three PRIMARY requirements for a penetration test are
- A . A defined goal, limited time period, and approval of management
- B . A general objective, unlimited time, and approval of the network administrator
- C . An objective statement, disclosed methodology, and fixed cost
- D . A stated objective, liability waiver, and disclosed methodology
A Java program is being developed to read a file from computer A and write it to computer B, using a third computer C. The program is not working as expected .
What is the MOST probable security feature of Java preventing the program from operating as intended?
- A . Least privilege
- B . Privilege escalation
- C . Defense in depth
- D . Privilege bracketing
Which of the following is an attacker MOST likely to target to gain privileged access to a system?
- A . Programs that write to system resources
- B . Programs that write to user directories
- C . Log files containing sensitive information
- D . Log files containing system calls
What would be the MOST cost effective solution for a Disaster Recovery (DR) site given that the organization’s systems cannot be unavailable for more than 24 hours?
- A . Warm site
- B . Hot site
- C . Mirror site
- D . Cold site
A Virtual Machine (VM) environment has five guest Operating Systems (OS) and provides strong isolation .
What MUST an administrator review to audit a user’s access to data files?
- A . Host VM monitor audit logs
- B . Guest OS access controls
- C . Host VM access controls
- D . Guest OS audit logs
When in the Software Development Life Cycle (SDLC) MUST software security functional requirements be defined?
- A . After the system preliminary design has been developed and the data security categorization has been performed
- B . After the vulnerability analysis has been performed and before the system detailed design begins
- C . After the system preliminary design has been developed and before the data security categorization begins
- D . After the business functional analysis and the data security categorization have been performed