CISSP: Certified Information Systems Security Professional

By ISC · Browse Mode
About the Exam

CISSP is ISC2's advanced cybersecurity certification for experienced security practitioners, managers, and executives. The exam covers eight domains: security and risk management, asset security, security architecture and engineering, communication and network security, identity and access management, security assessment and testing, security operations, and software development security. Passing demonstrates broad technical and managerial knowledge to design, engineer, and manage an organization's security posture.

Exam Topics

  • Security and Risk Management16%
  • Asset Security10%
  • Security Architecture and Engineering13%
  • Communication and Network Security13%
  • Identity and Access Management (IAM)13%
  • Security Assessment and Testing12%
  • Security Operations13%
  • Software Development Security10%

How to Use This Practice Exam

  1. Browse — Read each question, select your answer, and reveal the explanation.
  2. Exam Mode — Simulate real exam conditions with a timed session and score report.
  3. Learn Mode — Spaced repetition schedules questions you struggle with for long-term retention.

Download the Full Exam PDF

Get every question and answer in a clean, printable PDF built for offline study. Purchase once, keep permanent access, and re-download the latest version anytime.

Get PDF
Learn More

Last updated July 9, 2026 at 6:30 PM

Topic filter
Question status
Question sort
Questions per page

QuestionQ1

VerifiedAsset Security

Which control is MOST effective for monitoring the security of buried data lines within a facility’s perimeter?

Explanation

Ground sensors provide continuous detection of underground disturbance or tampering near buried data lines and can generate timely alerts through a security event management system.

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ2

VerifiedSecurity Assessment and Testing

When auditing the Software Development Life Cycle (SDLC), which of the following is a high-level audit phase?

Explanation

Planning is a high-level audit phase in which the audit scope, objectives, approach, resources, and relevant risks are established. Risk assessment is typically a planning activity, while requirements are an SDLC phase rather than an audit phase.

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ3

VerifiedCommunication and Network Security

An organization deploys Network Access Control (NAC) with Institute of Electrical and Electronics Engineers (IEEE) 802.1X and finds that its printers do not support the IEEE 802.1X standard. Which of the following is the BEST resolution?

Explanation

An IEEE 802.1X bridge can authenticate to the network for devices that do not have an IEEE 802.1X supplicant, allowing the printers to remain connected under the NAC design.

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ4

VerifiedCommunication and Network Security

At which Open Systems Interconnection (OSI) model layer does a circuit-level firewall function?

Explanation

A circuit-level firewall works at the session layer, monitoring and validating the establishment of network sessions (such as TCP handshakes) without performing deep inspection of application-layer content.

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ5

VerifiedCommunication and Network Security

Which dynamic routing protocol is BEST suited to a dispersed campus network that uses Internet Protocol version 6 (IPv6) addresses?

Explanation

OSPFv3 is a link-state interior gateway protocol designed to support IPv6 routing and to scale across an enterprise or campus network. Cisco documents OSPFv3 as supporting IPv6 unicast address families.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!
Know a question that should be here? Contribute to this exam
Back home