CISSP practice exam: 497 questions with full explanations

Questions on the exam

about 137 — vendor indicates, no fixed count published

Time allowed

180 minutes format →

Passing score

700 of 1000 — vendor, checked September 4, 2026 detail →

Exam fee

$749 — vendor, checked September 4, 2026 detail →

497 practice exam questions for CISSP, grouped by exam domain. Every question below shows all four options, which one is correct, and why each of the other three is not — the wrong answers are where most candidates lose marks.

Not sure where you stand? Take the free 5-min CISSP readiness check →

CISSP exam format →  ·  CISSP passing score →  · CISSP exam cost →

Questions by domain

• Security and Risk Management — 89 questions →
• Security Architecture and Engineering — 87 questions →
• Communication and Network Security — 63 questions →
• Identity and Access Management (IAM) — 63 questions →
• Software Development Security — 59 questions →
• Security Operations — 48 questions →
• Asset Security — 47 questions →
• Security Assessment and Testing — 41 questions →

Sample questions

$40,000: What is the Annual Loss Expectancy (ALE)?

1. $40,000 ✓

   Correct. SLE = AV × EF = $200,000 × 0.40 = $80,000. ARO = 0.5 (once every 2 years). ALE = SLE × ARO = $80,000 × 0.5 = $40,000.
2. $100,000

   Incorrect. This applies the wrong formula. ALE = SLE (AV × EF) × ARO = $200,000 × 0.40 × 0.5 = $40,000.
3. $160,000

   Incorrect. This would be the ALE if ARO = 2.0 (twice per year). The attack occurs once every two years, so ARO = 0.5.
4. $80,000

   Incorrect. $80,000 is the SLE (Single Loss Expectancy), not the ALE. The ALE adjusts for frequency: ALE = SLE × ARO = $80,000 × 0.5 = $40,000.

All 89 Security and Risk Management questions →

Neither operation is permitted: Under the Bell-LaPadula model, which operations are permitted?

1. Both operations are permitted

   Neither operation is permitted. Bell-LaPadula restricts both upward reads and downward writes to prevent information leakage from higher classification levels.
2. Read Top Secret is permitted; write to Unclassified is denied

   This reverses the model's rules. Bell-LaPadula's simple security property explicitly prohibits reading above one's clearance level (no read up).
3. Neither operation is permitted ✓

   Bell-LaPadula enforces 'no read up' (cannot read Top Secret with Secret clearance) and 'no write down' (*-property: cannot write to Unclassified from Secret level). Both operations violate the model.
4. Read Top Secret is denied; write to Unclassified is permitted

   Writing to a lower classification (downward write) is denied under the *-property of Bell-LaPadula, because it would allow classified data to leak to a lower level.

All 87 Security Architecture and Engineering questions →

Layer 7 for HTTP content inspection: Which OSI layers are associated with each control, respectively?

1. Layer 3 (Network) for HTTP inspection, Layer 3 (Network) for stateful filtering, and Layer 3 (Network) for ARP spoofing prevention

   Layer 3 handles IP routing and packet filtering. HTTP content inspection requires Layer 7 (application awareness), stateful inspection requires Layer 4 (TCP state), and ARP is a Layer 2 protocol — none of these are purely Layer 3 functions.
2. Layer 5 (Session) for HTTP content inspection, Layer 4 (Transport) for stateful filtering, and Layer 1 (Physical) for ARP spoofing prevention

   SSL/TLS sits at Layer 5/6, but HTTP application-layer inspection is Layer 7. ARP poisoning is a Layer 2 attack, not a Layer 1 (physical) issue. Physical layer deals with cables and signals, not MAC address-based ARP.
3. Layer 7 (Application) for HTTP inspection, Layer 3 (Network) for stateful filtering, and Layer 3 (Network) for ARP spoofing prevention

   While Layer 3 handles IP routing, stateful inspection tracks TCP connection state (Layer 4), not just IP packets. ARP is a Layer 2 protocol, not Layer 3 — ARP does not use IP addresses for its own operation.
4. Layer 7 (Application) for HTTP content inspection, Layer 4 (Transport) for stateful filtering, and Layer 2 (Data Link) for ARP protection ✓

   HTTP content inspection for injection attacks = Layer 7 (Application layer, where WAF/proxy operates). Stateful connection filtering = Layer 4 (Transport layer tracks TCP connection state). ARP operates at Layer 2 (Data Link), so ARP spoofing protection (Dynamic ARP Inspection) operates at Layer 2.

All 63 Communication and Network Security questions →

A password combined with a 6-digit numeric PIN: Which combination is NOT multi-factor authentication?

1. A password (Type 1) combined with a 6-digit numeric PIN (Type 1), because both are knowledge factors the user memorizes and recalls at login ✓

   MFA requires two or more DIFFERENT factor types. A password and a PIN are both Type 1 factors (something you know). Combining two of the same factor type is multi-step authentication, not multi-factor authentication. True MFA must span different categories (know + have, know + are, etc.).
2. A password (Type 1) combined with location verification from the corporate IP range (Type 4), pairing something the user knows with somewhere they are

   Password (something you know) + location verification (somewhere you are) represents two different factor types — this IS valid MFA, though Type 4 (location) is considered a weaker factor.
3. A smart card (Type 2) combined with a fingerprint scan (Type 3), pairing a token the user carries with a biometric trait unique to them

   Smart card (something you have) + fingerprint (something you are) represents two different factor types — this IS valid MFA. Many high-security systems use this combination.
4. A password (Type 1) combined with a TOTP code from an authenticator app (Type 2), pairing something known with a rotating code from a device held

   Password (something you know) + TOTP from authenticator app (something you have) represents two different factor types — this IS valid MFA. The authenticator app is the physical/digital possession (Type 2).

All 63 Identity and Access Management (IAM) questions →

Design phase; threat modeling during design identifies: At which SDLC phase should threat modeling be performe

1. Deployment phase; threat modeling here hardens the production environment and verifies configuration just before the application actually goes live to real users

   Deployment-phase security work is hardening, configuration review, and go-live verification — not initial threat modeling. By deployment the architecture and code are fixed, so modeling then only surfaces issues needing emergency patches or rollback.
2. Testing phase; threat modeling against the fully built application uncovers the real, exploitable vulnerabilities that only become visible once the running code is exercised

   Modeling in the Testing phase means all design and implementation decisions are already locked in. Though still useful, late modeling surfaces issues that demand expensive rework — it is most effective during Design while the architecture remains flexible.
3. Design phase; threat modeling during design identifies architectural security issues before code is written, when changes are least expensive ✓

   Threat modeling in the Design phase identifies architectural vulnerabilities — missing authentication boundaries, trust zone misalignments, insecure data flows — before they are built into the system. Changes at design time cost far less than rework after implementation. The 'Rule of Ten' states that fixing a bug in design costs 10x less than fixing it in testing, and 100x less than fixing it in production.
4. Maintenance phase; threat modeling performed on a yearly cadence as part of routine security review keeps the deployed system aligned with newly emerging threats over time

   Annual reviews during Maintenance do reassess threats against a deployed system, but threat modeling's primary value is in the Design phase before implementation. Maintenance-phase modeling is supplementary, not the primary opportunity.

All 59 Software Development Security questions →

Post-Incident Activity: Which NIST SP 800-61 incident response phase addresses the team meeting at the end?

1. Containment, Eradication, and Recovery phase

   Containment (isolating the server), Eradication (removing malware), and Recovery (restoring from backup) make up this phase. The lessons-learned meeting occurs in the Post-Incident Activity phase, which follows recovery.
2. Post-Incident Activity (Lessons Learned) ✓

   NIST SP 800-61 defines the final phase as Post-Incident Activity, which includes a lessons learned meeting to review what happened, evaluate the response effectiveness, identify process improvements, and update documentation. This is the phase where root cause analysis and recommendations for preventing recurrence are documented.
3. Preparation phase (pre-incident readiness)

   Preparation is the first phase — establishing policies, procedures, tools, and training before incidents occur. The lessons-learned meeting occurs after an incident, in the Post-Incident Activity phase.
4. Detection and Analysis of the incident

   Detection and Analysis is the second phase — detecting the anomaly, confirming the malware infection, and scoping the incident. It does not include lessons-learned meetings.

All 48 Security Operations questions →

Data owner: Who is responsible for determining the classification level of organizational data and approving a

1. Data owner ✓

   Correct. The data owner (typically a business manager or executive) is responsible for classifying data and approving who can access it. They bear business accountability for the data.
2. Data custodian

   Incorrect. The data custodian (typically IT operations) implements the controls specified by the data owner — backups, access controls, encryption. They don't determine classification.
3. Data user

   Incorrect. Data users consume data in their day-to-day work. They have no authority to classify data or approve others' access.
4. Security administrator

   Incorrect. Security administrators implement technical security controls. Classification and access approval are business decisions made by the data owner.

All 47 Asset Security questions →

Black box testing: Which testing approach is being used?

1. Gray box testing

   Gray box testing provides partial knowledge — typically user-level credentials or some network information — simulating an insider with limited access. The scenario provides no prior knowledge, which is black box.
2. Black box testing ✓

   Black box testing simulates an external attacker with no prior knowledge of the target systems. Testers start with only publicly available information (in this case, the domain name) and must discover everything themselves — mimicking how a real external attacker would begin.
3. White box testing

   White box testing provides testers with full knowledge: network diagrams, source code, system configurations, and credentials. It is the most thorough approach but does not simulate an uninformed external attacker.
4. Vulnerability assessment

   A vulnerability assessment identifies and reports vulnerabilities without attempting to exploit them. A penetration test actively attempts to exploit discovered vulnerabilities to demonstrate real-world impact. The scenario describes an active simulation of an attacker.

All 41 Security Assessment and Testing questions →

CISSP exam: the facts

How many questions are on the CISSP exam?

Around 137. The vendor does not publish a fixed count for CISSP, so this is the figure it indicates rather than a guaranteed number.

How long is the CISSP exam?

180 minutes. Across 137 questions that is about 79 seconds per question.

What topics does the CISSP exam cover?

8 domains: Security and Risk Management, Security Architecture and Engineering, Communication and Network Security, Identity and Access Management (IAM), Security Operations, Security Assessment and Testing, Software Development Security, Asset Security. Weights: Security and Risk Management 0.16%, Security Architecture and Engineering 0.13%, Communication and Network Security 0.13%, Identity and Access Management (IAM) 0.13%, Security Operations 0.13%, Security Assessment and Testing 0.12%, Software Development Security 0.1%, Asset Security 0.1%.

How many CISSP practice exam questions does Certsqill have?

497, spread across 8 exam domains. Every one shows all options, which is correct, and why each of the others is not.