CISSP (Certified Information Systems Security Professional) Practice Exam
2026 – 190 Scenario-Based Multiple Choice Questions & Answers with
Detailed Explanations | Complete Information Systems Security Certification
Study Guide, Test Bank, Practice Test, Exam Review & Test Preparation | 4-
Option MCQs | Eight CISSP Domains: Security & Risk Management, Asset
Security, Security Architecture & Engineering, Communications & Network
Security, Identity & Access Management, Security Assessment & Testing,
Security Operations & Software Development Security
Domain 1: Security and Risk Management
Question 1
A security manager is tasked with aligning the organization's security strategy with its overall business
goals. The primary objective is to ensure that security investments are justified and directly support
business objectives. Which of the following should be the manager's first step?
A. Conduct a comprehensive vulnerability assessment.
B. Define and document the organization's risk appetite.
C. Implement a new security awareness training program.
D. Purchase a next-generation firewall to block threats.
Correct Answer: B
,Explanation: Defining the risk appetite is the foundational step, as it establishes the amount of risk the
organization is willing to accept to achieve its goals, guiding all subsequent security decisions.
Question 2
An organization's primary data center is located in a region prone to hurricanes. The Board of Directors
is concerned about the potential for a multi-day outage and wants to understand the maximum
acceptable downtime for critical systems. Which metric should the security manager present to the
Board?
A. Recovery Point Objective (RPO)
B. Mean Time to Repair (MTTR)
C. Recovery Time Objective (RTO)
D. Mean Time Between Failures (MTBF)
Correct Answer: C
Explanation: The Recovery Time Objective (RTO) defines the maximum tolerable time that a system can
be down after a disruption, directly addressing the Board's concern about acceptable downtime.
Question 3
A multinational corporation must comply with the EU's General Data Protection Regulation (GDPR). The
company is establishing a process to handle data subject access requests (DSARs). Which role is
ultimately accountable for ensuring the organization's response to a DSAR is timely and compliant?
,A. The Data Protection Officer (DPO)
B. The Chief Information Security Officer (CISO)
C. The Data Controller
D. The Data Processor
Correct Answer: C
Explanation: Under GDPR, the Data Controller is the entity that determines the purposes and means of
processing personal data and holds ultimate accountability for compliance.
Question 4
A security analyst is reviewing a new software acquisition. The vendor claims their product is "secure by
design." The analyst needs to verify this claim by examining the product's development lifecycle. Which
of the following artifacts would provide the MOST direct evidence of this claim?
A. A recent third-party penetration test report.
B. The software's end-user license agreement (EULA).
C. The vendor's marketing brochure and whitepapers.
D. Secure coding standards and threat modeling documentation.
Correct Answer: D
, Explanation: Secure coding standards and threat modeling documents are direct outputs of a "secure by
design" philosophy, showing security was integrated from the start, not just tested at the end.
Question 5
An organization is evaluating the risk of moving its customer relationship management (CRM) system to
a public cloud provider. The security team is concerned about the potential for a shared tenancy
vulnerability. Which of the following is the MOST significant risk associated with this model?
A. A denial-of-service attack targeting the cloud provider's infrastructure.
B. The cloud provider's employees having access to the organization's data.
C. A vulnerability in the hypervisor allowing one tenant to access another tenant's data.
D. The loss of internet connectivity preventing access to the CRM system.
Correct Answer: C
Explanation: In a multi-tenant cloud environment, a hypervisor vulnerability is a critical concern, as it
could break the logical isolation between tenants and lead to a massive data breach.
Question 6
A company's security policy states that all employees must use a VPN when accessing corporate
resources from a public Wi-Fi network. A security engineer is asked to enforce this policy technically.
Which of the following solutions would BEST ensure compliance?
2026 – 190 Scenario-Based Multiple Choice Questions & Answers with
Detailed Explanations | Complete Information Systems Security Certification
Study Guide, Test Bank, Practice Test, Exam Review & Test Preparation | 4-
Option MCQs | Eight CISSP Domains: Security & Risk Management, Asset
Security, Security Architecture & Engineering, Communications & Network
Security, Identity & Access Management, Security Assessment & Testing,
Security Operations & Software Development Security
Domain 1: Security and Risk Management
Question 1
A security manager is tasked with aligning the organization's security strategy with its overall business
goals. The primary objective is to ensure that security investments are justified and directly support
business objectives. Which of the following should be the manager's first step?
A. Conduct a comprehensive vulnerability assessment.
B. Define and document the organization's risk appetite.
C. Implement a new security awareness training program.
D. Purchase a next-generation firewall to block threats.
Correct Answer: B
,Explanation: Defining the risk appetite is the foundational step, as it establishes the amount of risk the
organization is willing to accept to achieve its goals, guiding all subsequent security decisions.
Question 2
An organization's primary data center is located in a region prone to hurricanes. The Board of Directors
is concerned about the potential for a multi-day outage and wants to understand the maximum
acceptable downtime for critical systems. Which metric should the security manager present to the
Board?
A. Recovery Point Objective (RPO)
B. Mean Time to Repair (MTTR)
C. Recovery Time Objective (RTO)
D. Mean Time Between Failures (MTBF)
Correct Answer: C
Explanation: The Recovery Time Objective (RTO) defines the maximum tolerable time that a system can
be down after a disruption, directly addressing the Board's concern about acceptable downtime.
Question 3
A multinational corporation must comply with the EU's General Data Protection Regulation (GDPR). The
company is establishing a process to handle data subject access requests (DSARs). Which role is
ultimately accountable for ensuring the organization's response to a DSAR is timely and compliant?
,A. The Data Protection Officer (DPO)
B. The Chief Information Security Officer (CISO)
C. The Data Controller
D. The Data Processor
Correct Answer: C
Explanation: Under GDPR, the Data Controller is the entity that determines the purposes and means of
processing personal data and holds ultimate accountability for compliance.
Question 4
A security analyst is reviewing a new software acquisition. The vendor claims their product is "secure by
design." The analyst needs to verify this claim by examining the product's development lifecycle. Which
of the following artifacts would provide the MOST direct evidence of this claim?
A. A recent third-party penetration test report.
B. The software's end-user license agreement (EULA).
C. The vendor's marketing brochure and whitepapers.
D. Secure coding standards and threat modeling documentation.
Correct Answer: D
, Explanation: Secure coding standards and threat modeling documents are direct outputs of a "secure by
design" philosophy, showing security was integrated from the start, not just tested at the end.
Question 5
An organization is evaluating the risk of moving its customer relationship management (CRM) system to
a public cloud provider. The security team is concerned about the potential for a shared tenancy
vulnerability. Which of the following is the MOST significant risk associated with this model?
A. A denial-of-service attack targeting the cloud provider's infrastructure.
B. The cloud provider's employees having access to the organization's data.
C. A vulnerability in the hypervisor allowing one tenant to access another tenant's data.
D. The loss of internet connectivity preventing access to the CRM system.
Correct Answer: C
Explanation: In a multi-tenant cloud environment, a hypervisor vulnerability is a critical concern, as it
could break the logical isolation between tenants and lead to a massive data breach.
Question 6
A company's security policy states that all employees must use a VPN when accessing corporate
resources from a public Wi-Fi network. A security engineer is asked to enforce this policy technically.
Which of the following solutions would BEST ensure compliance?
