CISSP Exam Preparation

Complete a timed mixed-domain diagnostic question block without reference aids and record confidence for each answer.

Distinguish assets, threats, threat actors, vulnerabilities, exposures, safeguards, and risk in a security scenario.

Identify the primary confidentiality, integrity, or availability requirement and its business consequence in a scenario.

Classify a security control by its managerial, operational, technical, or physical category and by its preventive, detective, corrective, deterrent, recovery, or compensating function.

Calculate and interpret asset value, exposure factor, single loss expectancy, annualized rate of occurrence, and annualized loss expectancy.

Select a risk response and risk owner based on likelihood, impact, risk appetite, risk tolerance, and residual risk.

Prioritize a security response using life safety, legal and ethical duties, business objectives, risk ownership, policy, and technical feasibility.

Classify missed and guessed diagnostic questions as knowledge, judgment, reading, pacing, or confidence failures.

Select a security governance or risk-management framework that aligns controls and measurable security objectives with a stated business objective.

Differentiate policies, standards, procedures, guidelines, and baselines by purpose, authority, and level of detail.

Assign accountability among governing bodies, senior management, security leadership, risk owners, control owners, administrators, and independent assurance functions.

Apply due care and due diligence to a governance or risk-management scenario.

Determine the applicable legal, regulatory, contractual, jurisdictional, or privacy obligation in a security decision.

Apply the ISC2 Code of Ethics canons when professional, organizational, legal, or public-interest obligations conflict.

Select personnel security and role-based awareness controls for hiring, onboarding, role changes, recurring training, and termination.

Evaluate third-party risk using precontract assessment, contractual controls, assurance evidence, ongoing monitoring, incident obligations, and exit requirements.

Establish an information-asset inventory and map assets through creation, use, sharing, retention, archival, and destruction.

Assign data-owner, system-owner, custodian, processor, controller, and user responsibilities in a data-governance scenario.

Select a data classification level from sensitivity, criticality, business impact, and handling requirements.

Derive handling controls for data at rest, in transit, and in use from its classification and ownership requirements.

Choose retention and archival requirements based on legal, business, privacy, and operational needs.

Select clearing, purging, degaussing, destruction, or cryptographic-erasure methods based on media type, sensitivity, and reuse intent.

Apply data minimization, purpose limitation, and appropriate data-location controls to reduce privacy and security risk.

Apply least privilege, complete mediation, fail secure, economy of mechanism, open design, separation of privilege, and defense in depth to an architecture decision.

Identify the trusted computing base, reference monitor, security kernel, security perimeter, and trust boundaries in a system design.

Select Bell–LaPadula, Biba, Clark–Wilson, or Brewer–Nash for a stated confidentiality, integrity, or conflict-of-interest requirement.

Interpret Common Criteria concepts including protection profiles, security targets, targets of evaluation, and evaluation assurance levels.

Evaluate isolation and escape risks in virtual machines, containers, hypervisors, serverless services, and multitenant environments.

Select TPM, HSM, hardware roots of trust, attestation, and Secure Boot mechanisms for stated system-integrity and key-protection requirements.

Apply customer and provider responsibilities to an IaaS, PaaS, or SaaS security scenario.

Choose security design controls for a given mobile, embedded, IoT, edge-computing, or operational-technology environment.

Select symmetric encryption, asymmetric encryption, hashing, message authentication, key derivation, or digital signatures for a stated security objective.

Trace cryptographic keys through generation, distribution, storage, escrow, rotation, revocation, recovery, and destruction.

Validate a certificate chain using trust anchors, certificate fields, name and usage constraints, expiration, and revocation status.

Choose an appropriate cryptographic protocol for web traffic, messaging, remote access, wireless access, or site-to-site protection.

Recognize cryptographic failures involving obsolete algorithms, inadequate key lengths, poor randomness, key exposure, downgrade attacks, and incorrect implementation.

Compare brute-force, known-plaintext, chosen-plaintext, birthday, replay, and side-channel attacks and select appropriate mitigations.

Design layered site and facility controls using deterrent, preventive, detective, corrective, recovery, and compensating functions.

Select environmental safeguards for fire, water, temperature, humidity, power, static electricity, and equipment hazards.

Evaluate a network design for segmentation, least privilege, trust boundaries, resilient paths, and failure containment.

Compare perimeter-based and zero-trust access decisions in an enterprise scenario.

Select secure replacements and configurations for insecure management, file-transfer, email, directory, voice, and web protocols.

Choose controls for wireless, mobile, remote-access, and bring-your-own-device risks.

Select defense-in-depth controls for a network, transport, or session-layer attack scenario.

Evaluate firewall, proxy, IDS/IPS, network access control, load balancer, and secure-gateway placement in a given architecture.

Apply shared-responsibility, segmentation, encryption, and routing principles to hybrid-cloud network connectivity.

Distinguish identification, authentication, authorization, accounting, and accountability in an access scenario.

Select authentication factors and mechanisms based on required assurance, usability, context, and attack resistance.

Choose controls against password attacks, credential replay, session hijacking, multifactor fatigue, and account-recovery abuse.

Compare centralized identity, single sign-on, federation, identity-as-a-service, and common trust protocols for a business requirement.

Select discretionary, mandatory, role-based, rule-based, risk-based, or attribute-based access control for a stated need.

Apply least privilege, need to know, separation of duties, just-in-time access, and privileged-access management to administrative access.

Design joiner, mover, and leaver controls for the complete identity lifecycle.

Evaluate access-review evidence to identify excessive, orphaned, dormant, inherited, or conflicting access.

Select an assessment method based on the control, assurance objective, independence requirement, authority, and risk.

Define scope, rules of engagement, data handling, authorization, communication, and stop conditions for a security test.

Interpret authenticated and unauthenticated vulnerability-scan results while accounting for false positives, false negatives, and environmental context.

Differentiate vulnerability assessments, penetration tests, red-team exercises, control self-assessments, and audits by purpose, authority, and output.

Select an observation, interview, inspection, sampling, re-performance, or technical-testing method that produces sufficient and reliable evidence.

Use coverage, defect, vulnerability, incident, control-effectiveness, and remediation metrics to evaluate security performance.

Prioritize findings by exploitability, asset criticality, business impact, compensating controls, exposure, and remediation constraints.

Use separation of duties, job rotation, mandatory vacation, dual control, and two-person integrity to reduce operational fraud and error.

Choose log sources, event detail, time synchronization, retention, protection, and correlation needed for a detection objective.

Use threat intelligence to refine monitoring and response priorities without treating unverified indicators as established facts.

Prioritize vulnerability remediation and patch deployment based on asset criticality, exposure, threat intelligence, compensating controls, and operational risk.

Evaluate configuration-baseline drift and system changes using formal approval, testing, rollback planning, documentation, and emergency-change protocols.

Apply preparation, detection, analysis, containment, eradication, recovery, and lessons learned to an incident scenario.

Preserve digital evidence using identification, collection, acquisition, integrity verification, chain of custody, and secure storage.

Choose an administrative, civil, criminal, regulatory, or internal investigation approach based on authority, evidence requirements, privacy, and business impact.

Conduct a business impact analysis that identifies critical processes, dependencies, resource requirements, and impacts over time.

Derive recovery time objective, recovery point objective, maximum tolerable downtime, and work recovery time from business requirements.

Select preventive, response, recovery, continuity, and resilience strategies for a disruption scenario.

Differentiate business continuity, disaster recovery, crisis communication, emergency response, and continuity-of-operations plans.

Choose backup types, protection methods, storage locations, restoration sequences, and validation procedures for a recovery objective.

Select hot, warm, cold, mobile, reciprocal, or cloud recovery arrangements based on recovery requirements and business constraints.

Choose tabletop, checklist, walkthrough, simulation, parallel, or full-interruption exercises and use the results to improve plans.

Map security activities and decision gates to requirements, design, implementation, testing, deployment, operation, maintenance, and disposal phases.

Derive testable security and privacy requirements from a business use case, misuse case, and data-flow description.

Use threat modeling to identify assets, entry points, trust boundaries, threats, and required mitigations in an application design.

Select secure design and coding controls for input validation, output encoding, injection, memory-safety, and error-handling weaknesses.

Select secure design and coding controls for application authentication, session management, authorization, and access-control weaknesses.

Differentiate static, dynamic, interactive, composition, fuzz, and penetration testing by the defects and lifecycle stages each addresses.

Apply code signing, dependency governance, secrets management, build isolation, and pipeline protection to software supply-chain risk.

Evaluate acquired software, outsourced development, and cloud services using assurance evidence, acceptance criteria, contractual requirements, and ongoing monitoring.

Resolve a cross-domain security scenario by identifying the asset, business objective, threat, risk owner, applicable obligation, and decision priority.

Select the best answer when several technically valid options differ in governance level, sequence, risk ownership, cost, or business fit.

Distinguish actions that belong to governing bodies, senior management, security leadership, data owners, administrators, auditors, legal counsel, and incident responders.

Complete a 40–50 minute mixed-domain question block using an explicit read, identify, qualify, eliminate, and select method.

Analyze missed and guessed questions to identify the earliest knowledge, interpretation, role-selection, sequencing, or judgment step that failed.

Build a prioritized remediation plan from error frequency, current CISSP blueprint weight, confidence calibration, and consequence of misunderstanding.

Complete a second timed mixed-domain block targeting identified weaknesses and compare its accuracy, pacing, and confidence with the diagnostic baseline.

Create and rehearse an exam-day plan aligned with current official CISSP exam rules, including pacing, breaks, uncertainty management, and answer-finalization constraints.