CISSP Practice Questions: Domain 3 and Domain 5 Scenarios That Decide the Exam
Here are 8-10 CISSP practice questions designed to match the rigor and scenario-based style of the actual ISC2 exam, covering multiple domains.
Instructions: Choose the single best answer for each question, as you would in the real exam. Pay close attention to the details in the scenario, as they are designed to point you toward the correct answer. For background on this area, read CISSP Passing Score: What a 700 on a 1000-Point Scale Really Means.
Question 1
A security manager is reviewing the organization's business continuity plan (BCP). The plan lists the maximum amount of time a critical business process can be unavailable before causing irreparable harm to the organization. Which metric is the plan defining?
Answer: C
Explanation: MTD (Maximum Tolerable Downtime) is the total amount of time a business process can be down before the organization faces irreparable harm. The RTO is the time to restore the process, which is usually less than the MTD. The RPO refers to the acceptable amount of data loss, while an SLA is a contractual agreement, not an internal BCP metric.
Question 2
An organization has implemented a new cloud-based file-sharing service for its employees. The security team is concerned about data leakage. Which control would be the MOST effective in preventing sensitive data from being uploaded to the service?
Answer: B
Explanation: A DLP solution that inspects content in real-time is a preventive control that stops the data from leaving the organization's control. Encryption protects data at rest but does not prevent the initial upload. MFA protects access to the account but not the data the user is authorized to upload. Logging is a detective control, which only identifies the incident after it has occurred.
Question 3
A developer is writing code that will process a file uploaded by a user. The code checks that the file extension is .pdf but does not inspect the file's actual content. Which of the following attacks is the developer MOST likely trying to prevent, and what is the flaw in this approach?
Answer: C
Explanation: The developer is attempting to prevent a malicious file upload by whitelisting extensions. However, an attacker can easily rename a malicious executable or script to have a .pdf extension. The correct approach is to validate the file's magic bytes (header) and use an antivirus scanner, not rely on the extension, which is a superficial and easily bypassed control.
Question 4
An organization's network is divided into multiple VLANs. A security analyst is investigating a report of unusual traffic from the finance department's VLAN to the marketing department's VLAN. The analyst needs to capture the raw packets traversing between these two VLANs. What is the MOST efficient way to accomplish this? Readers also benefit from CISSP Difficulty: Why 25 Years of Security Experience Is Not Enough.
Answer: A
Explanation: Port mirroring (SPAN) on the switch that routes traffic between the VLANs allows the analyst to copy all traffic to a dedicated port for analysis without disrupting the network. Installing agents on all hosts is invasive and inefficient. Firewall logs provide summary information, not raw packet contents. The gateway may not see all intra-VLAN traffic if routing occurs on a different switch.
Question 5
A security administrator is configuring a new web application and needs to ensure that session tokens are not exposed to client-side scripts. Which HTTP header should the administrator set to enforce this control?
Answer: C
Explanation: The HttpOnly attribute on the Set-Cookie header prevents client-side JavaScript from accessing the cookie via document.cookie, mitigating the impact of XSS attacks. X-Frame-Options prevents clickjacking, CSP is for content restrictions, and HSTS enforces secure HTTPS connections.
Question 6
During a forensic investigation, an analyst needs to preserve the integrity of evidence on a seized hard drive. The analyst creates a bit-for-bit copy of the drive and then hashes the original and the copy. What is the PRIMARY purpose of hashing both the original and the copy?
Answer: B
Explanation: Hashing (e.g., SHA-256) creates a unique digital fingerprint of the data. If the hash of the copy matches the hash of the original, it proves the copy is forensically sound and has not been altered, maintaining the chain of custody. Hashing is not compression, encryption, or used for file system identification.
Question 7
A company is developing a new mobile application that collects user location data. To comply with privacy regulations, the company wants to ensure that users are clearly informed about what data is collected and how it will be used before they download the app. What is the MOST appropriate control to implement?
Answer: B You can explore this further in CISSP Study Plan: 6-Month Road Map to Associate and Beyond.
Explanation: A privacy notice is a public-facing document that clearly explains an organization's data collection and usage practices, fulfilling the "notice" principle of privacy. A PIA is an internal risk assessment tool, a retention policy is about data storage timeframes, and a EULA is a legal contract, but the privacy notice is the specific mechanism for informing users about data practices.
Question 8
An organization's security team is reviewing its incident response plan. They want to ensure that the plan can be executed effectively during a major incident. Which of the following is the MOST important activity to perform on a regular basis?
Answer: B
Explanation: A tabletop exercise is a low-cost, high-value activity that simulates an incident and walks the team through the plan, identifying gaps in roles, communication, and procedures. While updating contacts and reviewing threats are important, they are not as effective as testing the plan's execution. Purchasing software is a resource allocation, not a test of the plan itself.
Question 9
A database administrator is implementing security controls for a new database containing customer PII. The security policy requires that the data be unreadable if the physical storage media is stolen. Which of the following controls BEST meets this requirement?
Answer: B
Explanation: Full-disk or file-level encryption protects data at rest. If the physical media is stolen, the data is unreadable without the decryption key. Access controls, redaction, and network segmentation protect the data while in use or in transit, but do not protect the raw data on the storage device itself.
Question 10
A security architect is designing a new data center. To ensure high availability for a critical application, they want to implement a solution that allows multiple servers to share the same workload and if one server fails, the others automatically take over with no downtime. Which of the following concepts does this describe?
Answer: B
Explanation: Clustering involves grouping multiple servers to work as a single system. It provides high availability by automatically distributing the load and failing over between nodes, often with no perceptible interruption. Failover is a component of clustering (the act of switching), but clustering is the overarching architecture. RAID protects against disk failure, and a cold site is a long-term DR facility, not a high-availability solution. --- These questions represent the analytical depth required for the CISSP exam. Remember that the key to success is not just memorizing definitions, but understanding how concepts apply in complex, real-world scenarios and being able to select the best answer among several technically plausible options. Good luck with your studies.
A free CISSP study plan gives you a week-by-week schedule that fits the time you have available before exam day.
Want to know if you are actually ready? ISC2 Certified Information Systems Security Professional (CISSP) exam questions give you a straight answer.
A free CISSP readiness check lets you answer practice questions across the exam topics and see which domain needs the most review.