CISSP – CERTIFIED INFORMATION SYSTEMS SECURITY
PROFESSIONAL – EXAM QUESTIONS AND CORRECT
ANSWERS (VERIFIED ANSWERS) PLUS RATIONALE | 2027
Q&A | INSTANT DOWNLOAD PDF
1. An organization is reviewing its information security objectives after a change in
business strategy. Which security principle should be considered when
determining whether information is available to authorized users when needed?
A. Confidentiality
B. Integrity
C. Availability
D. Nonrepudiation
Rationale: Availability ensures that authorized users can access information and systems when
required. Confidentiality limits unauthorized disclosure, integrity protects against unauthorized
modification, and nonrepudiation supports proof of origin or action.
2. A security manager discovers that a database administrator can approve a
change and also implement that same change in production. Which security
principle is most directly violated?
A. Defense in depth
B. Separation of duties
C. Data minimization
D. Nonrepudiation
Rationale: Separation of duties divides sensitive responsibilities among different individuals or
roles so that one person cannot control an entire critical process. This reduces the opportunity
for unauthorized activity or fraud.
3. A company requires employees to use only the minimum permissions necessary
to perform their assigned duties. Which principle is being applied?
A. Least privilege
B. Open design
C. Fail-safe default
D. Job rotation
Rationale: Least privilege grants users only the access necessary to perform their authorized
tasks. It reduces the potential impact of compromised accounts and accidental or intentional
misuse.
4. A security professional discovers that a system contains a serious vulnerability.
Management decides to accept the risk because remediation would cost
, substantially more than the expected loss. Which risk response has been
selected?
A. Risk avoidance
B. Risk transfer
C. Risk mitigation
D. Risk acceptance
Rationale: Risk acceptance occurs when an organization knowingly retains a risk after
evaluating its potential impact and response costs. Avoidance eliminates the risky activity,
mitigation reduces the risk, and transfer shifts some financial or operational consequences to
another party.
5. During a governance review, an executive asks why the security program should
be aligned with organizational objectives. What is the primary reason?
A. To eliminate every technical vulnerability
B. To ensure that security operates independently of business priorities
C. To ensure security supports the organization's mission and risk objectives
D. To replace business management decisions with security decisions
Rationale: Information security should support the organization's mission, objectives, and
acceptable risk level. Security decisions are most effective when they are integrated with
business strategy rather than treated as an isolated technical function.
6. An organization is preparing to evaluate whether a critical business process can
continue after a major disruption. Which activity should establish the potential
business consequences of losing that process?
A. Vulnerability assessment
B. Business impact analysis
C. Penetration test
D. Source-code review
Rationale: A business impact analysis identifies the effects of disruption on critical business
processes and helps determine recovery priorities and requirements. The other activities
evaluate technical security rather than business continuity impacts.
7. A security officer is determining whether a proposed security control satisfies
organizational requirements. Which factor should be considered first?
A. Whether the control is popular in the industry
B. Whether another company uses the same technology
C. Whether the control has the newest features
D. Whether the control addresses the organization's identified risk and requirements
, Rationale: Controls should be selected based on identified risks, business requirements, legal
obligations, and security objectives. Popularity or novelty does not establish that a control is
appropriate for a particular environment.
8. A company is developing a security policy for employees who handle sensitive
customer information. What should the policy primarily establish?
A. Management's expectations and required security behavior
B. The exact source code used by security applications
C. The physical architecture of every network device
D. The detailed implementation of every security mechanism
Rationale: Policies express management direction, expectations, and required behavior.
Standards, procedures, and guidelines provide progressively more specific implementation
guidance.
9. A security manager wants to determine whether a third-party supplier could
introduce malicious or counterfeit components into the organization's technology
environment. Which area is most relevant?
A. Business continuity testing
B. Security awareness
C. Supply chain risk management
D. Data classification
Rationale: Supply chain risk management addresses risks associated with acquiring products
and services from suppliers, including counterfeit components, tampering, compromised
products, and insufficient supplier controls.
10. A security analyst is constructing a model that identifies potential attackers,
assets, attack paths, and possible mitigations before a system is deployed. What
activity is being performed?
A. Vulnerability scanning
B. Threat modeling
C. Incident containment
D. Security auditing
Rationale: Threat modeling systematically examines assets, threats, attack paths, and
mitigations during design or development. It helps identify security weaknesses before they
become operational problems.
11. An employee is leaving an organization after working with highly sensitive
systems. Which personnel-security action is most important during the
termination process?
PROFESSIONAL – EXAM QUESTIONS AND CORRECT
ANSWERS (VERIFIED ANSWERS) PLUS RATIONALE | 2027
Q&A | INSTANT DOWNLOAD PDF
1. An organization is reviewing its information security objectives after a change in
business strategy. Which security principle should be considered when
determining whether information is available to authorized users when needed?
A. Confidentiality
B. Integrity
C. Availability
D. Nonrepudiation
Rationale: Availability ensures that authorized users can access information and systems when
required. Confidentiality limits unauthorized disclosure, integrity protects against unauthorized
modification, and nonrepudiation supports proof of origin or action.
2. A security manager discovers that a database administrator can approve a
change and also implement that same change in production. Which security
principle is most directly violated?
A. Defense in depth
B. Separation of duties
C. Data minimization
D. Nonrepudiation
Rationale: Separation of duties divides sensitive responsibilities among different individuals or
roles so that one person cannot control an entire critical process. This reduces the opportunity
for unauthorized activity or fraud.
3. A company requires employees to use only the minimum permissions necessary
to perform their assigned duties. Which principle is being applied?
A. Least privilege
B. Open design
C. Fail-safe default
D. Job rotation
Rationale: Least privilege grants users only the access necessary to perform their authorized
tasks. It reduces the potential impact of compromised accounts and accidental or intentional
misuse.
4. A security professional discovers that a system contains a serious vulnerability.
Management decides to accept the risk because remediation would cost
, substantially more than the expected loss. Which risk response has been
selected?
A. Risk avoidance
B. Risk transfer
C. Risk mitigation
D. Risk acceptance
Rationale: Risk acceptance occurs when an organization knowingly retains a risk after
evaluating its potential impact and response costs. Avoidance eliminates the risky activity,
mitigation reduces the risk, and transfer shifts some financial or operational consequences to
another party.
5. During a governance review, an executive asks why the security program should
be aligned with organizational objectives. What is the primary reason?
A. To eliminate every technical vulnerability
B. To ensure that security operates independently of business priorities
C. To ensure security supports the organization's mission and risk objectives
D. To replace business management decisions with security decisions
Rationale: Information security should support the organization's mission, objectives, and
acceptable risk level. Security decisions are most effective when they are integrated with
business strategy rather than treated as an isolated technical function.
6. An organization is preparing to evaluate whether a critical business process can
continue after a major disruption. Which activity should establish the potential
business consequences of losing that process?
A. Vulnerability assessment
B. Business impact analysis
C. Penetration test
D. Source-code review
Rationale: A business impact analysis identifies the effects of disruption on critical business
processes and helps determine recovery priorities and requirements. The other activities
evaluate technical security rather than business continuity impacts.
7. A security officer is determining whether a proposed security control satisfies
organizational requirements. Which factor should be considered first?
A. Whether the control is popular in the industry
B. Whether another company uses the same technology
C. Whether the control has the newest features
D. Whether the control addresses the organization's identified risk and requirements
, Rationale: Controls should be selected based on identified risks, business requirements, legal
obligations, and security objectives. Popularity or novelty does not establish that a control is
appropriate for a particular environment.
8. A company is developing a security policy for employees who handle sensitive
customer information. What should the policy primarily establish?
A. Management's expectations and required security behavior
B. The exact source code used by security applications
C. The physical architecture of every network device
D. The detailed implementation of every security mechanism
Rationale: Policies express management direction, expectations, and required behavior.
Standards, procedures, and guidelines provide progressively more specific implementation
guidance.
9. A security manager wants to determine whether a third-party supplier could
introduce malicious or counterfeit components into the organization's technology
environment. Which area is most relevant?
A. Business continuity testing
B. Security awareness
C. Supply chain risk management
D. Data classification
Rationale: Supply chain risk management addresses risks associated with acquiring products
and services from suppliers, including counterfeit components, tampering, compromised
products, and insufficient supplier controls.
10. A security analyst is constructing a model that identifies potential attackers,
assets, attack paths, and possible mitigations before a system is deployed. What
activity is being performed?
A. Vulnerability scanning
B. Threat modeling
C. Incident containment
D. Security auditing
Rationale: Threat modeling systematically examines assets, threats, attack paths, and
mitigations during design or development. It helps identify security weaknesses before they
become operational problems.
11. An employee is leaving an organization after working with highly sensitive
systems. Which personnel-security action is most important during the
termination process?
