CISSP – CERTIFIED INFORMATION SYSTEMS SECURITY
PROFESSIONAL – EXAM QUESTIONS AND CORRECT
ANSWERS (VERIFIED ANSWERS) PLUS RATIONALE | 2027
Q&A | INSTANT DOWNLOAD PDF
1. An organization is reviewing its information security objectives after several
business units adopted new cloud-based services. Which principle should MOST
directly guide the security team's priorities?
A. Maximizing the number of technical controls
B. Aligning security objectives with business goals and risk
C. Requiring identical security controls for every system
D. Eliminating all residual risk from business operations
Rationale: Security governance should support the organization's mission, objectives, and
acceptable risk posture. Security is most effective when controls are selected according to
business requirements rather than implemented uniformly without considering risk.
2. Which security objective is primarily concerned with preventing unauthorized
disclosure of information?
A. Integrity
B. Availability
C. Nonrepudiation
D. Confidentiality
Rationale: Confidentiality protects information from unauthorized access or disclosure. Integrity
addresses unauthorized modification, while availability concerns timely and reliable access.
3. A security manager discovers that an administrator has been accessing sensitive
customer records without a documented business need. Which security principle
is MOST directly violated?
A. Need-to-know
B. Availability
C. Nonrepudiation
D. Data remanence
Rationale: Need-to-know limits access to information based on a legitimate requirement to
perform assigned duties. Administrative privileges alone do not justify access to unrelated
sensitive information.
4. A company wants to ensure that an electronic transaction can be attributed to the
person who performed it and that the individual cannot credibly deny performing
the transaction. Which security property is MOST applicable?
,A. Availability
B. Integrity
C. Nonrepudiation
D. Confidentiality
Rationale: Nonrepudiation provides evidence supporting the origin or performance of an action
and helps prevent a party from successfully denying an action later.
5. A security officer is asked to approve a control even though the officer knows the
control does not adequately address the identified risk. What is the MOST
appropriate professional response?
A. Approve it because management requested approval
B. Report the deficiency accurately and explain the associated risk
C. Approve it temporarily without documenting the weakness
D. Ignore the issue unless a security incident occurs
Rationale: Professional ethics require security practitioners to act honestly and protect the
interests of the organization and stakeholders. Known deficiencies should be accurately
communicated rather than concealed.
6. Senior management wants to understand how information security contributes to
organizational objectives. Which activity BEST demonstrates effective security
governance?
A. Increasing the number of security alerts reviewed each day
B. Requiring administrators to change passwords weekly
C. Purchasing additional security appliances annually
D. Mapping security objectives to business strategy and risk tolerance
Rationale: Governance connects security activities to business strategy, objectives,
responsibilities, and risk. Technical activity alone does not demonstrate strategic alignment.
7. During a risk assessment, an organization identifies a vulnerable public-facing
application that could expose sensitive customer information. What should be
performed FIRST?
A. Determine the likelihood and potential impact of exploitation
B. Purchase cybersecurity insurance
C. Immediately replace the application
D. Disable all external connectivity permanently
Rationale: Risk analysis requires understanding the likelihood and impact associated with a
threat exploiting a vulnerability. This information supports an informed risk treatment decision.
, 8. Which document normally establishes management's high-level direction and
expectations regarding information security?
A. Procedure
B. Guideline
C. Policy
D. Configuration baseline
Rationale: A policy expresses management's intent and establishes high-level requirements.
Procedures provide detailed steps, while guidelines generally provide recommendations.
9. A security architect is developing requirements for a new application.
Management states that some risk may remain after controls are implemented.
What concept does this describe?
A. Inherent vulnerability
B. Threat avoidance
C. Risk elimination
D. Residual risk
Rationale: Residual risk is the risk remaining after security controls and other risk treatment
measures have been applied. Risk cannot normally be reduced to zero without disproportionate
cost or operational consequences.
10. An organization decides not to implement an expensive control because the cost
of the control substantially exceeds the expected reduction in risk. Which risk
treatment approach is being considered?
A. Risk transference
B. Risk acceptance
C. Risk avoidance
D. Risk escalation
Rationale: Risk acceptance occurs when an organization knowingly retains a risk within its
defined tolerance. The decision should be documented and made by an appropriate authority.
11. A company purchases cybersecurity insurance to reduce the financial
consequences of a potential breach. Which risk response is this?
A. Avoidance
B. Acceptance
C. Transfer
D. Mitigation
Rationale: Risk transfer shifts some financial consequences or responsibilities associated with a
risk to another party. Insurance is a common example.
PROFESSIONAL – EXAM QUESTIONS AND CORRECT
ANSWERS (VERIFIED ANSWERS) PLUS RATIONALE | 2027
Q&A | INSTANT DOWNLOAD PDF
1. An organization is reviewing its information security objectives after several
business units adopted new cloud-based services. Which principle should MOST
directly guide the security team's priorities?
A. Maximizing the number of technical controls
B. Aligning security objectives with business goals and risk
C. Requiring identical security controls for every system
D. Eliminating all residual risk from business operations
Rationale: Security governance should support the organization's mission, objectives, and
acceptable risk posture. Security is most effective when controls are selected according to
business requirements rather than implemented uniformly without considering risk.
2. Which security objective is primarily concerned with preventing unauthorized
disclosure of information?
A. Integrity
B. Availability
C. Nonrepudiation
D. Confidentiality
Rationale: Confidentiality protects information from unauthorized access or disclosure. Integrity
addresses unauthorized modification, while availability concerns timely and reliable access.
3. A security manager discovers that an administrator has been accessing sensitive
customer records without a documented business need. Which security principle
is MOST directly violated?
A. Need-to-know
B. Availability
C. Nonrepudiation
D. Data remanence
Rationale: Need-to-know limits access to information based on a legitimate requirement to
perform assigned duties. Administrative privileges alone do not justify access to unrelated
sensitive information.
4. A company wants to ensure that an electronic transaction can be attributed to the
person who performed it and that the individual cannot credibly deny performing
the transaction. Which security property is MOST applicable?
,A. Availability
B. Integrity
C. Nonrepudiation
D. Confidentiality
Rationale: Nonrepudiation provides evidence supporting the origin or performance of an action
and helps prevent a party from successfully denying an action later.
5. A security officer is asked to approve a control even though the officer knows the
control does not adequately address the identified risk. What is the MOST
appropriate professional response?
A. Approve it because management requested approval
B. Report the deficiency accurately and explain the associated risk
C. Approve it temporarily without documenting the weakness
D. Ignore the issue unless a security incident occurs
Rationale: Professional ethics require security practitioners to act honestly and protect the
interests of the organization and stakeholders. Known deficiencies should be accurately
communicated rather than concealed.
6. Senior management wants to understand how information security contributes to
organizational objectives. Which activity BEST demonstrates effective security
governance?
A. Increasing the number of security alerts reviewed each day
B. Requiring administrators to change passwords weekly
C. Purchasing additional security appliances annually
D. Mapping security objectives to business strategy and risk tolerance
Rationale: Governance connects security activities to business strategy, objectives,
responsibilities, and risk. Technical activity alone does not demonstrate strategic alignment.
7. During a risk assessment, an organization identifies a vulnerable public-facing
application that could expose sensitive customer information. What should be
performed FIRST?
A. Determine the likelihood and potential impact of exploitation
B. Purchase cybersecurity insurance
C. Immediately replace the application
D. Disable all external connectivity permanently
Rationale: Risk analysis requires understanding the likelihood and impact associated with a
threat exploiting a vulnerability. This information supports an informed risk treatment decision.
, 8. Which document normally establishes management's high-level direction and
expectations regarding information security?
A. Procedure
B. Guideline
C. Policy
D. Configuration baseline
Rationale: A policy expresses management's intent and establishes high-level requirements.
Procedures provide detailed steps, while guidelines generally provide recommendations.
9. A security architect is developing requirements for a new application.
Management states that some risk may remain after controls are implemented.
What concept does this describe?
A. Inherent vulnerability
B. Threat avoidance
C. Risk elimination
D. Residual risk
Rationale: Residual risk is the risk remaining after security controls and other risk treatment
measures have been applied. Risk cannot normally be reduced to zero without disproportionate
cost or operational consequences.
10. An organization decides not to implement an expensive control because the cost
of the control substantially exceeds the expected reduction in risk. Which risk
treatment approach is being considered?
A. Risk transference
B. Risk acceptance
C. Risk avoidance
D. Risk escalation
Rationale: Risk acceptance occurs when an organization knowingly retains a risk within its
defined tolerance. The decision should be documented and made by an appropriate authority.
11. A company purchases cybersecurity insurance to reduce the financial
consequences of a potential breach. Which risk response is this?
A. Avoidance
B. Acceptance
C. Transfer
D. Mitigation
Rationale: Risk transfer shifts some financial consequences or responsibilities associated with a
risk to another party. Insurance is a common example.
