CISSP Exam 2026: Professional Certification Practice Test —
Security & Risk Management, Asset Security, Architecture, Network
Security, Identity & Access, Security Operations & Software
Development — 190 Multiple-Choice Questions with Answers &
Detailed Rationales
DOMAIN 1: SECURITY AND RISK MANAGEMENT (Questions 1–28)
Question 1
A security manager is tasked with aligning the organization's security strategy with its
business objectives. Which of the following BEST describes the primary purpose of security
governance?
A. Implementing technical controls to prevent unauthorized access
B. Ensuring security activities support and enable business goals
C. Conducting penetration tests to identify vulnerabilities
D. Deploying firewalls at all network boundaries
Correct Answer: B
Explanation: Security governance aligns security strategy with business objectives, ensuring
security enables rather than hinders organizational goals.
Question 2
An organization has determined that a specific risk has a low likelihood but catastrophic
impact. Which risk response strategy is MOST appropriate when the cost of mitigation
exceeds potential losses?
,A. Risk avoidance
B. Risk transfer
C. Risk acceptance
D. Risk mitigation
Correct Answer: C
Explanation: Risk acceptance is appropriate when mitigation costs exceed potential losses
and the organization consciously accepts the residual risk.
Question 3
A security analyst is calculating the annualized loss expectancy (ALE) for a data center. The
asset value is $2,000,000, the exposure factor is 40%, and the annualized rate of occurrence
is 0.25. What is the ALE?
A. $100,000
B. $200,000
C. $500,000
D. $800,000
Correct Answer: B
Explanation: ALE = SLE × ARO = ($2,000,000 × 0.40) × 0.25 = $800,000 × 0.25 = $200,000.
Question 4
Which of the following BEST describes the difference between a policy and a procedure?
,A. Policies are technical; procedures are administrative
B. Policies are mandatory; procedures are optional
C. Policies state what must be done; procedures describe how to do it
D. Policies are created by IT; procedures are created by management
Correct Answer: C
Explanation: Policies are high-level mandatory statements of intent, while procedures
provide detailed step-by-step instructions for implementation.
Question 5
A multinational corporation must comply with GDPR, HIPAA, and PCI DSS simultaneously.
Which approach BEST addresses these overlapping regulatory requirements?
A. Implement separate security programs for each regulation
B. Create a unified control framework mapping common requirements
C. Focus only on the most stringent regulation
D. Outsource compliance to a third-party auditor
Correct Answer: B
Explanation: A unified control framework maps overlapping requirements, reducing
duplication and ensuring comprehensive compliance across regulations.
Question 6
, During a risk assessment, a team identifies that a legacy system cannot be patched and
poses a significant vulnerability. Which risk response is being applied when the organization
decides to decommission the system?
A. Risk mitigation
B. Risk transfer
C. Risk avoidance
D. Risk acceptance
Correct Answer: C
Explanation: Risk avoidance eliminates the risk entirely by discontinuing the activity or
system that introduces the risk.
Question 7
Which of the following is the PRIMARY responsibility of a data owner?
A. Implementing security controls
B. Classifying data and determining access levels
C. Monitoring network traffic
D. Conducting security audits
Correct Answer: B
Explanation: Data owners are responsible for classifying information and determining who
should have access based on business needs.
Question 8
Security & Risk Management, Asset Security, Architecture, Network
Security, Identity & Access, Security Operations & Software
Development — 190 Multiple-Choice Questions with Answers &
Detailed Rationales
DOMAIN 1: SECURITY AND RISK MANAGEMENT (Questions 1–28)
Question 1
A security manager is tasked with aligning the organization's security strategy with its
business objectives. Which of the following BEST describes the primary purpose of security
governance?
A. Implementing technical controls to prevent unauthorized access
B. Ensuring security activities support and enable business goals
C. Conducting penetration tests to identify vulnerabilities
D. Deploying firewalls at all network boundaries
Correct Answer: B
Explanation: Security governance aligns security strategy with business objectives, ensuring
security enables rather than hinders organizational goals.
Question 2
An organization has determined that a specific risk has a low likelihood but catastrophic
impact. Which risk response strategy is MOST appropriate when the cost of mitigation
exceeds potential losses?
,A. Risk avoidance
B. Risk transfer
C. Risk acceptance
D. Risk mitigation
Correct Answer: C
Explanation: Risk acceptance is appropriate when mitigation costs exceed potential losses
and the organization consciously accepts the residual risk.
Question 3
A security analyst is calculating the annualized loss expectancy (ALE) for a data center. The
asset value is $2,000,000, the exposure factor is 40%, and the annualized rate of occurrence
is 0.25. What is the ALE?
A. $100,000
B. $200,000
C. $500,000
D. $800,000
Correct Answer: B
Explanation: ALE = SLE × ARO = ($2,000,000 × 0.40) × 0.25 = $800,000 × 0.25 = $200,000.
Question 4
Which of the following BEST describes the difference between a policy and a procedure?
,A. Policies are technical; procedures are administrative
B. Policies are mandatory; procedures are optional
C. Policies state what must be done; procedures describe how to do it
D. Policies are created by IT; procedures are created by management
Correct Answer: C
Explanation: Policies are high-level mandatory statements of intent, while procedures
provide detailed step-by-step instructions for implementation.
Question 5
A multinational corporation must comply with GDPR, HIPAA, and PCI DSS simultaneously.
Which approach BEST addresses these overlapping regulatory requirements?
A. Implement separate security programs for each regulation
B. Create a unified control framework mapping common requirements
C. Focus only on the most stringent regulation
D. Outsource compliance to a third-party auditor
Correct Answer: B
Explanation: A unified control framework maps overlapping requirements, reducing
duplication and ensuring comprehensive compliance across regulations.
Question 6
, During a risk assessment, a team identifies that a legacy system cannot be patched and
poses a significant vulnerability. Which risk response is being applied when the organization
decides to decommission the system?
A. Risk mitigation
B. Risk transfer
C. Risk avoidance
D. Risk acceptance
Correct Answer: C
Explanation: Risk avoidance eliminates the risk entirely by discontinuing the activity or
system that introduces the risk.
Question 7
Which of the following is the PRIMARY responsibility of a data owner?
A. Implementing security controls
B. Classifying data and determining access levels
C. Monitoring network traffic
D. Conducting security audits
Correct Answer: B
Explanation: Data owners are responsible for classifying information and determining who
should have access based on business needs.
Question 8
