How are CISSP questions generated?

dotCreds builds CISSP practice questions from public exam objectives and ISC2 exam and documentation references. The questions are written for realistic study practice, not copied from exam dumps.

How are explanations sourced?

Each question includes an explanation and, when available, a source link back to the provider documentation or reference used to validate the answer. That keeps the practice tied to study material you can actually review.

The page tracks today's answered count and accuracy for the 10-question daily set, then saves a 7-day score history on this device so you can see your recent practice trend.

The site is the fastest way to start CISSP practice without installing anything. It is built for daily recall, quick weak-topic discovery, and source-backed explanations you can review immediately.

Free CISSP Practice Test

CISSP Practice Test

Start today’s free 10-question CISSP set with source-backed explanations, local progress, and a fresh rotation every morning.

10 Free Daily Questions Source-backed Explanations 200 Verified Questions

Questions updated at Aug 23, 2026, 8:12 PM CDT

Unlock the full CISSP bank

200 verified questions Exam Mode Practice Mode Detailed explanations Weak-area review No subscription - one-time unlock

Get the complete source-backed bank with Interview Questions, the full Study Guide, full Course Notes, detailed explanations, weak-area review, and exam-style practice.

Interview Questions Full Study Guide Full Course Notes Exam Mode Practice Mode Guided Course Detailed explanations Weak-area review No subscription

What you get with free practice

10 Free Questions Daily Fresh set every day from the live bank

Detailed Explanations Learn with clear source-backed answers

Track Your Progress Daily history and performance insights

Upgrade Anytime Unlock the full bank when you are ready

Question 1 of 10

Objective Apply recovery strategies 7. Security Operations (13%)

A financial institution is developing its information system contingency plan. During the business impact analysis, the IT department identifies that a 72-hour outage of the core banking system would result in an estimated loss of $5 million per day due to inability to process transactions. Considering the seven steps of information system contingency planning, what is the most critical immediate action the institution should undertake to mitigate this risk?

Concept tested:

Source:Contingency Planning Guide for Federal Information Systems (NIST SP 800-34 Rev. 1)

Question 2 of 10

Objective Establish handling requirements 2. Asset Security (10%)

An organization is implementing a media disposition process for sensitive data. After sanitizing storage media, the organization must ensure the data is irrecoverable. What is the PRIMARY action that should be taken to maintain data integrity and demonstrate compliance?

Concept tested:

Question 3 of 10

Objective Apply cryptographic solutions 3. Security Architecture and Engineering (13%)

An organization uses a symmetric authentication key alongside a symmetric data encryption/decryption key. The organization’s security policy mandates the use of a single key for both authentication and encryption. What key type should be utilized?

Concept tested:

Question 4 of 10

Objective Apply software security controls 8. Software Development Security (10%)

A software development organization is establishing a Secure Development Lifecycle (SDLC) program. Which foundational element, as defined by the Secure Software Development Framework (SSDF), is most critical for ensuring the organization’s preparedness to perform secure software development activities?

Concept tested:

Question 5 of 10

Objective Manage identification and authentication 5. Identity and Access Management (13%)

A financial institution is implementing a new online banking service. The service handles sensitive account information and requires user authentication. A risk assessment identifies that a compromise of authentication could lead to significant financial loss and reputational damage. According to identity assurance level guidelines, what is the appropriate initial assurance level to select for this service?

Concept tested:

Question 6 of 10

Objective Design assessment strategies 6. Security Assessment and Testing (12%)

An organization is updating its security assessment report. Previous assessments contain valuable information. What is the most critical factor when incorporating this prior data?

Concept tested:

Question 7 of 10

Objective Apply incident management 7. Security Operations (13%)

A response team has contained a suspected malware incident but lacks enough evidence to decide when recovery should begin. Investigators must support forensics and recovery by establishing what occurred and why. Which analysis should they perform next?

Concept tested:

Question 8 of 10

Objective Apply risk management 1. Security and Risk Management (16%)

An organization's risk assessment process identifies a critical system, responsible for processing payroll data, as vulnerable to a newly identified ransomware threat. The system's compromise could result in significant financial loss and reputational damage. To ensure ongoing risk mitigation, what is the most effective approach?

Concept tested:

Question 9 of 10

Objective Apply secure network architecture 4. Communication and Network Security (13%)

An organization is designing its network security architecture and needs to implement firewall policies. Which statement best describes the primary purpose of a firewall policy regarding network traffic?

Concept tested:

Question 10 of 10

Objective Apply data protection methods 2. Asset Security (10%)

An organization is assessing the data protection level for a system containing classified information. The system employs strong encryption and access controls. Considering the complementary nature of data protection and organizational controls, what is the most appropriate conclusion?

Concept tested:

Unlock the full CISSP bank.

Get the full bank, Exam Mode, Practice Mode, question sets, random tests, readiness tracking, saved box scores, and review tools for this exam.

The PDF versions keep questions first and move the answer review, explanations, and distractor notes to the back of the file.

200 verified exam-style questions Every choice explained Exam Mode and Practice Mode Question sets and random tests Readiness score and trends Previous test box scores

You've answered 0/10 questions in today's set.

Locked: 190 more questions in the full bank.

Locked: exam simulation mode, practice mode, readiness tracking, and saved review history.

Checkout stays on this page, so you can keep practicing, unlock the full bank, and start Exam Mode or Practice Mode when you are ready.

Cheat Sheets

Question 1 A financial institution is developing its information system contingency plan. During the business impact analysis, the IT department identifies that a 72-hour outage of the core banking system would result in an estimated loss of $5 million per day due to inability to process transactions. Considering the seven steps of information system contingency planning, what is the most critical immediate action the institution should undertake to mitigate this risk?

Answer choices

A. Implement robust preventative controls to minimize the likelihood of system failures, within the defined security and accountability boundaries.
B. Conduct a thorough risk assessment to identify potential disruptions and vulnerabilities, under the stated decision criteria.
C. Develop the Information System Contingency Plan (ISCP) focusing on immediate recovery strategies, within the defined security and accountability boundaries.
D. Train personnel on the ISCP and conduct initial testing exercises, for the required business outcome.

Correct answer

Develop the Information System Contingency Plan (ISCP) focusing on immediate recovery strategies, within the defined security and accountability boundaries.

Information system contingency planning focuses on recovering systems and data after a disruption, following a structured seven-step process. Prioritizing the ISCP development ensures immediate recovery strategies are in place to mitigate potential financial losses.

Wrong-answer review

A. Implement robust preventative controls to minimize the likelihood of system failures, within the defined security and accountability boundaries.: Implementing preventative controls is a long-term strategy and doesn't address the immediate need for recovery planning.
B. Conduct a thorough risk assessment to identify potential disruptions and vulnerabilities, under the stated decision criteria.: A risk assessment is a necessary step, but it doesn't provide the immediate recovery actions required.
D. Train personnel on the ISCP and conduct initial testing exercises, for the required business outcome.: Training and testing are important, but they come after the plan itself is developed and in place.

Extra learning features

Why candidates miss this

The distractor ‘Implement robust preventative controls to minimize the likelihood of system failures’ is tempting because it addresses a general security concern. However, it doesn’t directly tackle the immediate, time-sensitive issue of recovering from a known outage. The decisive clue is the specific timeframe (72 hours) and the associated financial loss, which necessitates a focused recovery plan. Likely wrong answer: Implement robust preventative controls to minimize the likelihood of system failures Review focus: Contingency Planning Guide for Federal Information Systems (NIST SP 800-34 Rev. 1)

Why this matters

Understanding the immediate financial impact of a 72-hour outage—$5 million per day—highlights the critical need for rapid recovery strategies. Implementing a robust ISCP, as the question requires, directly addresses this risk by establishing a framework for minimizing downtime and financial losses, ensuring business continuity and protecting the institution's reputation. This causal chain emphasizes the importance of proactive planning in mitigating potential disasters.

Objective/domain: 7. Security Operations (13%)

Question 2 An organization is implementing a media disposition process for sensitive data. After sanitizing storage media, the organization must ensure the data is irrecoverable. What is the PRIMARY action that should be taken to maintain data integrity and demonstrate compliance?

A. Immediately shred the media and dispose of it in a secure landfill, for the described technical objective and its associated operational control requirements, for the described technical objective and its associated operational control requirements, within the defined security and accountability boundaries.
B. Apply a new marking indicating the updated confidentiality level, unless the device is leaving the organization and is stored in a location where access is carefully controlled until the device leaves the organization to prevent reintroduction of sensitive data, under the organization’s defined implementation and exception-management process.
C. Maintain detailed records of the sanitization process, including the method used, personnel involved, and verification results, for the described technical objective and its associated operational control requirements, for the described technical objective and its associated operational control requirements, for the stated requirement.
D. Return the media to the original vendor for refurbishment and reuse, for the described technical objective and its associated operational control requirements, for the described technical objective and its associated operational control requirements, as the recommended response to this scenario.

Maintain detailed records of the sanitization process, including the method used, personnel involved, and verification results, for the described technical objective and its associated operational control requirements, for the described technical objective and its associated operational control requirements, for the stated requirement.

Objective/domain: 2. Asset Security (10%)

Source: Guidelines for Media Sanitization (NIST SP 800-88 Rev. 1)

Question 3 An organization uses a symmetric authentication key alongside a symmetric data encryption/decryption key. The organization’s security policy mandates the use of a single key for both authentication and encryption. What key type should be utilized?

A. A public signature-verification key, as configured.
B. A symmetric authentication key, for the affected environment.
C. A public ephemeral key-agreement key, for the specified implementation requirement.
D. A symmetric data encryption/decryption key, for the stated requirement.

A symmetric data encryption/decryption key, for the stated requirement.

Objective/domain: 3. Security Architecture and Engineering (13%)

Source: Recommendation for Key Management: Part 1 (NIST SP 800-57 Part 1 Rev. 5)

Question 4 A software development organization is establishing a Secure Development Lifecycle (SDLC) program. Which foundational element, as defined by the Secure Software Development Framework (SSDF), is most critical for ensuring the organization’s preparedness to perform secure software development activities?

A. Conducting regular security awareness training for all software developers, for the described technical objective and its associated operational control requirements, in the described situation.
B. Establishing a formal vulnerability disclosure program for external researchers, as the selected approach for the stated technical and business outcome, for this task.
C. Implementing a strict change management process for all software releases, as the selected approach for the stated technical and business outcome.
D. Ensuring that the organization’s people, processes, and technology are prepared to perform secure software development at the organization level, under the documented operational and governance requirements.

Ensuring that the organization’s people, processes, and technology are prepared to perform secure software development at the organization level, under the documented operational and governance requirements.

Objective/domain: 8. Software Development Security (10%)

Source: Secure Software Development Framework (NIST SP 800-218)

Question 5 A financial institution is implementing a new online banking service. The service handles sensitive account information and requires user authentication. A risk assessment identifies that a compromise of authentication could lead to significant financial loss and reputational damage. According to identity assurance level guidelines, what is the appropriate initial assurance level to select for this service?

A. AAL2, under this approach.
B. AAL1
C. AAL3, in practice.
D. AAL4, for the affected environment.

AAL2, under this approach.

Objective/domain: 5. Identity and Access Management (13%)

Source: Digital Identity Guidelines (NIST SP 800-63-4)

Question 6 An organization is updating its security assessment report. Previous assessments contain valuable information. What is the most critical factor when incorporating this prior data?

A. Ensuring the information remains relevant to the current system environment and risk profile.
B. Prioritizing assessments based on the assessor's personal preference, as the selected response to the described condition.
C. Including all previous assessment data regardless of its applicability, as the primary proposed approach.
D. Focusing solely on the most recent assessment to ensure accuracy, for the specified implementation requirement.

Ensuring the information remains relevant to the current system environment and risk profile.

Objective/domain: 6. Security Assessment and Testing (12%)

Source: Assessing Security and Privacy Controls in Information Systems and Organizations (NIST SP 800-53A Rev. 5)

Question 7 A response team has contained a suspected malware incident but lacks enough evidence to decide when recovery should begin. Investigators must support forensics and recovery by establishing what occurred and why. Which analysis should they perform next?

A. Restore all systems immediately without considering operational disruption, under this approach.
B. Calculate financial loss before preserving the incident timeline, for evaluation.
C. Determine the event sequence, involved assets, and root cause, for the specified implementation requirement.
D. Close the investigation once containment has succeeded, for the specified implementation requirement.

Determine the event sequence, involved assets, and root cause, for the specified implementation requirement.

Source: Incident Response Recommendations and Considerations for Cybersecurity Risk Management (NIST SP 800-61 Rev. 3)

Question 8 An organization's risk assessment process identifies a critical system, responsible for processing payroll data, as vulnerable to a newly identified ransomware threat. The system's compromise could result in significant financial loss and reputational damage. To ensure ongoing risk mitigation, what is the most effective approach?

A. Immediately implement a compensating control without further analysis, as the primary proposed approach.
B. Conduct a full system rebuild to eliminate the potential threat, for review.
C. Document the vulnerability and accept the associated risk, within the documented operational, security, ownership, and validation requirements.
D. Update the system's security baseline and schedule a follow-up assessment, under organization-wide implementation-governance requirements.

Update the system's security baseline and schedule a follow-up assessment, under organization-wide implementation-governance requirements.

Objective/domain: 1. Security and Risk Management (16%)

Source: Guide for Conducting Risk Assessments (NIST SP 800-30 Rev. 1)

Question 9 An organization is designing its network security architecture and needs to implement firewall policies. Which statement best describes the primary purpose of a firewall policy regarding network traffic?

A. To allow all network traffic to pass through the firewall without any restrictions, within the defined security and accountability boundaries.
B. To automatically detect and block all malicious network traffic, for the described technical objective and its associated operational control requirements, for this task.
C. To define how the firewall should handle inbound and outbound network traffic based on security requirements, for consideration.
D. To prioritize network traffic based on user-defined policies, as the selected response to the described condition.

To define how the firewall should handle inbound and outbound network traffic based on security requirements, for consideration.

Objective/domain: 4. Communication and Network Security (13%)

Source: Guidelines on Firewalls and Firewall Policy (NIST SP 800-41 Rev. 1)

Question 10 An organization is assessing the data protection level for a system containing classified information. The system employs strong encryption and access controls. Considering the complementary nature of data protection and organizational controls, what is the most appropriate conclusion?

A. The data protection level should be assessed based on the potential impact of a compromise, under this approach.
B. The data protection level should remain at the base level due to the existing controls, as described.
C. The data protection level should be increased to reflect the enhanced controls, as the recommended response to this scenario.
D. The data protection level should be determined solely by the organizational control measures, under the documented operational and governance requirements.

The data protection level should be assessed based on the potential impact of a compromise, under this approach.

CISSP Practice Test

Unlock the full CISSP bank

Practice with explanations that teach.

What you get with free practice

An organization is implementing a media disposition process for sensitive data. After sanitizing storage media, the organization must ensure the data is irrecoverable. What is the PRIMARY action that should be taken to maintain data integrity and demonstrate compliance?

An organization uses a symmetric authentication key alongside a symmetric data encryption/decryption key. The organization’s security policy mandates the use of a single key for both authentication and encryption. What key type should be utilized?

An organization is updating its security assessment report. Previous assessments contain valuable information. What is the most critical factor when incorporating this prior data?

A response team has contained a suspected malware incident but lacks enough evidence to decide when recovery should begin. Investigators must support forensics and recovery by establishing what occurred and why. Which analysis should they perform next?

An organization is designing its network security architecture and needs to implement firewall policies. Which statement best describes the primary purpose of a firewall policy regarding network traffic?

An organization is assessing the data protection level for a system containing classified information. The system employs strong encryption and access controls. Considering the complementary nature of data protection and organizational controls, what is the most appropriate conclusion?

You are viewing today’s free 10. Unlock 190 more questions.

Build your practice session

Set your target once.

Customize your session

Unlock the full CISSP bank.

7-day score keeper

Keep today’s practice moving

Answer choices

Correct answer

Wrong-answer review

Extra learning features

Why candidates miss this

Why this matters

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

How are CISSP questions generated?

How are explanations sourced?

What score do I get?

Why use this site?