CISSP Exam 2026 – 190 Practice Questions with Answers & Detailed
Rationales, Security and Risk Management, Asset Security, Security
Architecture, Network Security, IAM, Security Assessment,
Operations & Software Development Security
Domain 1: Security and Risk Management (Questions 1–30)
Question 1
A multinational corporation is expanding operations into the European Union and must
demonstrate compliance with GDPR for processing employee and customer data. The Chief
Privacy Officer asks the security manager to identify the MOST appropriate mechanism for
lawful cross-border data transfers to the company's U.S.-based data center.
A. Rely on the company's existing ISO 27001 certification as proof of adequacy
B. Implement Standard Contractual Clauses approved by the European Commission
C. Obtain consent from every individual whose data will be transferred
D. Register the data processing with the U.S. Department of Commerce
Correct Answer: B
Explanation: Standard Contractual Clauses provide a recognized legal mechanism for EU-to-
U.S. data transfers when adequacy decisions do not apply. Consent alone is fragile and
operationally impractical at scale.
Question 2
A security analyst is performing a quantitative risk assessment. The asset value is $500,000.
The exposure factor is 40%. The annualized rate of occurrence is 0.25. What is the
Annualized Loss Expectancy (ALE)?
,A. $50,000
B. $75,000
C. $200,000
D. $500,000
Correct Answer: A
Explanation: ALE = SLE × ARO. SLE = AV × EF = $500,000 × 0.40 = $200,000. ALE = $200,000 ×
0.25 = $50,000.
Question 3
Which risk treatment strategy involves transferring risk to a third party through a contractual
agreement?
A. Risk avoidance
B. Risk mitigation
C. Risk transference
D. Risk acceptance
Correct Answer: C
Explanation: Risk transference shifts financial impact to another entity, typically via
insurance or contractual indemnification clauses. The organization retains reputational and
operational risk.
Question 4
,A security manager is developing a business continuity plan and needs to determine the
maximum tolerable downtime for a critical payment processing system. Which metric BEST
represents this requirement?
A. Recovery Point Objective (RPO)
B. Recovery Time Objective (RTO)
C. Maximum Tolerable Downtime (MTD)
D. Service Level Agreement (SLA)
Correct Answer: C
Explanation: MTD represents the total time a business process can be unavailable before
unacceptable consequences occur. RTO is the target recovery time, which must be less than
MTD.
Question 5
An organization's security policy states that all employees must complete annual security
awareness training. A new contractor begins work and asks to defer training for six months
due to project deadlines. What is the MOST appropriate response from the security
manager?
A. Grant the deferral since contractors are not full-time employees
B. Require training completion before granting system access
C. Allow the deferral but restrict access to public information only
D. Escalate to the project manager for a risk decision
Correct Answer: B
, Explanation: Security awareness training is a baseline control applicable to all personnel with
system access. Deferral creates unmanaged risk regardless of employment classification.
Question 6
Which principle of the (ISC)² Code of Ethics requires a security professional to "act
honorably, honestly, justly, responsibly, and legally"?
A. Protect society, the common good, necessary public trust and confidence, and the
infrastructure
B. Act honorably, honestly, justly, responsibly, and legally
C. Provide diligent and competent service to principals
D. Advance and protect the profession
Correct Answer: B
Explanation: This canonical imperative directly addresses personal and professional conduct
standards expected of all certified members.
Question 7
A company is evaluating a cloud service provider for hosting regulated data. The vendor
offers a SOC 2 Type II report. What does this report PRIMARILY provide assurance about?
A. The vendor's financial stability
B. The design and operating effectiveness of controls over time
C. The vendor's compliance with GDPR
D. The security of the vendor's software code
Rationales, Security and Risk Management, Asset Security, Security
Architecture, Network Security, IAM, Security Assessment,
Operations & Software Development Security
Domain 1: Security and Risk Management (Questions 1–30)
Question 1
A multinational corporation is expanding operations into the European Union and must
demonstrate compliance with GDPR for processing employee and customer data. The Chief
Privacy Officer asks the security manager to identify the MOST appropriate mechanism for
lawful cross-border data transfers to the company's U.S.-based data center.
A. Rely on the company's existing ISO 27001 certification as proof of adequacy
B. Implement Standard Contractual Clauses approved by the European Commission
C. Obtain consent from every individual whose data will be transferred
D. Register the data processing with the U.S. Department of Commerce
Correct Answer: B
Explanation: Standard Contractual Clauses provide a recognized legal mechanism for EU-to-
U.S. data transfers when adequacy decisions do not apply. Consent alone is fragile and
operationally impractical at scale.
Question 2
A security analyst is performing a quantitative risk assessment. The asset value is $500,000.
The exposure factor is 40%. The annualized rate of occurrence is 0.25. What is the
Annualized Loss Expectancy (ALE)?
,A. $50,000
B. $75,000
C. $200,000
D. $500,000
Correct Answer: A
Explanation: ALE = SLE × ARO. SLE = AV × EF = $500,000 × 0.40 = $200,000. ALE = $200,000 ×
0.25 = $50,000.
Question 3
Which risk treatment strategy involves transferring risk to a third party through a contractual
agreement?
A. Risk avoidance
B. Risk mitigation
C. Risk transference
D. Risk acceptance
Correct Answer: C
Explanation: Risk transference shifts financial impact to another entity, typically via
insurance or contractual indemnification clauses. The organization retains reputational and
operational risk.
Question 4
,A security manager is developing a business continuity plan and needs to determine the
maximum tolerable downtime for a critical payment processing system. Which metric BEST
represents this requirement?
A. Recovery Point Objective (RPO)
B. Recovery Time Objective (RTO)
C. Maximum Tolerable Downtime (MTD)
D. Service Level Agreement (SLA)
Correct Answer: C
Explanation: MTD represents the total time a business process can be unavailable before
unacceptable consequences occur. RTO is the target recovery time, which must be less than
MTD.
Question 5
An organization's security policy states that all employees must complete annual security
awareness training. A new contractor begins work and asks to defer training for six months
due to project deadlines. What is the MOST appropriate response from the security
manager?
A. Grant the deferral since contractors are not full-time employees
B. Require training completion before granting system access
C. Allow the deferral but restrict access to public information only
D. Escalate to the project manager for a risk decision
Correct Answer: B
, Explanation: Security awareness training is a baseline control applicable to all personnel with
system access. Deferral creates unmanaged risk regardless of employment classification.
Question 6
Which principle of the (ISC)² Code of Ethics requires a security professional to "act
honorably, honestly, justly, responsibly, and legally"?
A. Protect society, the common good, necessary public trust and confidence, and the
infrastructure
B. Act honorably, honestly, justly, responsibly, and legally
C. Provide diligent and competent service to principals
D. Advance and protect the profession
Correct Answer: B
Explanation: This canonical imperative directly addresses personal and professional conduct
standards expected of all certified members.
Question 7
A company is evaluating a cloud service provider for hosting regulated data. The vendor
offers a SOC 2 Type II report. What does this report PRIMARILY provide assurance about?
A. The vendor's financial stability
B. The design and operating effectiveness of controls over time
C. The vendor's compliance with GDPR
D. The security of the vendor's software code
