CISSP

One question per exam domain, 8 in all, each with the answer, the reasoning behind it, and the public source it was written from. Read them here with no account. These are original questions written against the published exam outline, not real exam items.

1. Question 1 · Security and Risk Management

   A county gives the same thirty-minute annual awareness module to all three thousand employees. Phishing results have been flat for two years and developers say the content is irrelevant. What would MOST improve the program?

   1. ATie completion of the annual module to performance reviews so that employees give the content more attention.
   2. BAdd role-based training tailored to the specific risks of each job function, layered on the common awareness baseline.
   3. CReplace the annual module with a shorter monthly micro-learning series delivered to all staff so retention improves.
   4. DIncrease the frequency of phishing simulations from quarterly to monthly so that practice is more regular.
   Show answer and explanation

   Correct answer

   Add role-based training tailored to the specific risks of each job function, layered on the common awareness baseline.

   General awareness establishes a common baseline, but people change behavior when the content maps to decisions they actually make, and a developer maintaining a public portal faces secure coding and dependency risks that a generic module never touches. Layering role-based training on the baseline addresses both the flat results and the relevance complaint, and it reaches roles such as finance and privileged administrators whose mistakes carry the most impact. Monthly phishing simulations increase exposure to one attack vector and, delivered too often, produce fatigue and gaming of the test rather than improved judgment. A monthly micro-learning series improves cadence and retention, which is a real benefit, but delivering the same irrelevant content in smaller pieces does not solve the relevance problem. Tying completion to performance reviews raises the completion rate, which is already high, and completion has never been the constraint here.

   Source: NIST SP 800-50 Rev. 1: Building a Cybersecurity and Privacy Learning Program

2. Question 2 · Asset Security

   A genomics institute ships weekly backup tapes offsite by courier, and one shipment holding sequencing data traceable to named participants was lost in transit. Which control would MOST reduce the impact of a recurrence?

   1. ASplit each backup across two tapes shipped on separate days so that no single lost shipment is complete.
   2. BMove to a courier that provides GPS-tracked custody and signature capture at every handoff in the custody chain.
   3. CRequire dual-person integrity at every handoff along with a signed manifest reconciled at the vault.
   4. DEncrypt the backup media before it leaves the facility, with keys held separately and never shipped with it.
   Show answer and explanation

   Correct answer

   Encrypt the backup media before it leaves the facility, with keys held separately and never shipped with it.

   The concern here is impact rather than likelihood, and encrypting the media with keys held separately means a lost tape becomes an inventory problem instead of a disclosure of identifiable participant data. That protection holds regardless of who loses the tape or how. A tracked courier lowers the chance of loss and speeds recovery, but a tape that does go missing is still readable, so the worst case is unchanged. Splitting a backup across two shipments reduces how much is exposed at once while still exposing identifiable records, and it doubles the number of shipments that can go astray. Dual-person integrity and a reconciled manifest tighten chain of custody and would detect the loss sooner, which again addresses likelihood and detection rather than the consequence of an unprotected tape in a stranger's hands.

   Source: NIST SP 800-111: Guide to Storage Encryption Technologies for End User Devices

3. Question 3 · Security Architecture and Engineering

   A national laboratory's mandatory confidentiality policy forbids writes to a lower classification, so scientists cannot publish sanitized summaries. The director wants it relaxed. As the architect, what is the BEST response?

   1. AIntroduce a controlled downgrade path performed by an authorized trusted subject, with documented review and audit of each release
   2. BKeep the control unchanged and have scientists request printed extracts that they retype into the unclassified environment
   3. CGrant scientists a standing exception permitting writes to a lower classification when they attest the content is sanitized
   4. DLower the classification of the source repositories so that publishing a sanitized summary is no longer a downward write
   Show answer and explanation

   Correct answer

   Introduce a controlled downgrade path performed by an authorized trusted subject, with documented review and audit of each release

   A mandatory confidentiality model anticipates this exact tension and resolves it with a trusted subject: a limited, authorized entity permitted to perform a downgrade under review, so the policy holds for everyone else while the mission need is met through an accountable path. Granting every scientist a standing attestation based exception is the fastest answer and it is how many organizations quietly fail, because it converts a mandatory control into a discretionary one and removes the independent check that catches an honest sanitization mistake. Reclassifying source repositories downward resolves the symptom by discarding the protection the classification represented. Directing scientists to retype printed extracts leaves the control formally intact while creating an unmonitored transfer channel with no review, which is worse than the sanctioned downgrade because nothing is recorded.

   Source: NISTIR 7316: Assessment of Access Control Systems

4. Question 4 · Communication and Network Security

   A media company plans to carry block storage traffic over the same switching fabric as workstations and rendering nodes using a converged protocol. Reviewing the security implications before purchase, what should you raise FIRST?

   1. AThe company should keep a separate physical fabric for storage because converged designs cannot be secured adequately for block traffic
   2. BStorage protocols on a shared fabric assume a trusted transport, so the design needs initiator authentication and isolated storage flows
   3. CStorage traffic should be compressed at the initiator so that it consumes a smaller share of the shared fabric during peaks
   4. DConverged storage traffic will consume bandwidth that rendering nodes need, so the fabric must be sized for peak simultaneous load
   Show answer and explanation

   Correct answer

   Storage protocols on a shared fabric assume a trusted transport, so the design needs initiator authentication and isolated storage flows

   Converged designs are perfectly defensible, but the storage protocols riding on them were built for a dedicated fabric and generally assume the transport is trusted, so the security conversation must be about initiator authentication and enforced isolation of the storage flows. Raising that first steers the purchase toward a design that can be secured rather than one that is retrofitted. Capacity planning for peak load is a legitimate and necessary engineering concern, and it addresses availability rather than the trust assumption. Compression at the initiator is an optimization with no bearing on who is permitted to attach to a target. Declaring that converged fabrics cannot be secured is an overstatement that the vendor will rightly rebut, and overstating a risk costs credibility on the points that actually matter.

   Source: NIST SP 800-209: Security Guidelines for Storage Infrastructure

5. Question 5 · Identity and Access Management (IAM)

   A native mobile app embeds its client secret in the binary, shows the login screen in an embedded web view, and receives the authorization code via a custom URL scheme. Which change BEST reduces credential and code theft?

   1. AObfuscate the binary so that the embedded client secret cannot be recovered by decompiling the application package
   2. BPin the authorization server's certificate inside the application to prevent interception of the authorization code
   3. CTreat the application as a public client and use the authorization code flow with a proof key, through the system browser
   4. DSwitch to a grant in which the application collects the user's password directly, so that no redirect is involved at any point
   Show answer and explanation

   Correct answer

   Treat the application as a public client and use the authorization code flow with a proof key, through the system browser

   Anything shipped inside an installed application is public by definition, so the correct posture is to stop pretending the client can hold a secret and instead bind the authorization code to the instance that requested it using a proof key. Using the system browser rather than an embedded web view also stops the application from seeing the user's credentials and lets the user verify the real address bar. Obfuscation delays extraction of a secret that remains recoverable and leaves the code interception path open. Certificate pinning protects the transport but not the redirect, which is where a malicious application registering the same custom scheme steals the code. Collecting the password directly in the application is the pattern current guidance explicitly discourages, because it trains users to hand credentials to third party software.

   Source: RFC 8252: OAuth 2.0 for Native Apps

6. Question 6 · Security Assessment and Testing

   A county has 60 assessment findings across property tax, elections and public works systems, and the administrator has funded roughly a third of the remediation this year. As security manager, what should you do FIRST?

   1. ARemediate every finding affecting the elections support systems, since public confidence in elections is the county's most sensitive concern
   2. BAsk the external assessor to rank the findings, since the assessor is independent and has the deepest technical understanding of each one
   3. CConduct a risk assessment of likelihood and mission impact for each finding, then present a prioritized remediation plan for the administrator
   4. DRemediate the findings with the lowest remediation cost, so that the largest number of items can be closed within the available funding
   Show answer and explanation

   Correct answer

   Conduct a risk assessment of likelihood and mission impact for each finding, then present a prioritized remediation plan for the administrator

   Control selection and remediation sequencing follow from risk, so the first step is to assess likelihood and mission impact and then bring management a prioritized plan, since accepting the residual risk on the unfunded remainder is a decision the administrator must make and own. Concentrating everything on elections systems may well be where the analysis lands, but choosing the destination before performing the analysis leaves the other two mission areas unexamined. Optimizing for cheapest-first maximizes the count of closed findings and looks productive in reporting while potentially leaving the highest-impact exposures untouched. Asking the assessor to rank is tempting given their technical depth, but the assessor does not own the county's mission priorities or risk tolerance and should not be making acceptance decisions.

   Source: NIST SP 800-30 Rev. 1, Guide for Conducting Risk Assessments

7. Question 7 · Security Operations

   An Ohio retailer confirms an attacker accessed order records for customers in the United States, Germany, and Brazil. Containment is complete, and the marketing officer wants a customer email sent within the hour. What is BEST?

   1. AEngage legal counsel to determine which jurisdictions apply, what each one requires, and what the notice must contain
   2. BNotify the payment card brands and the acquiring bank first, then decide about customer notification based on their guidance
   3. CSend the notification immediately, since prompt transparency limits reputational harm and regulators favor early disclosure
   4. DHold all notification until the forensic investigation delivers a final report so that the message is complete and accurate
   Show answer and explanation

   Correct answer

   Engage legal counsel to determine which jurisdictions apply, what each one requires, and what the notice must contain

   Breach notification is a legal obligation whose deadlines, required content, and recipients differ by jurisdiction, and three sets of residents here implicate three different regimes with different clocks. Counsel determines those obligations, and an uncoordinated communication can create admissions, contradict a later required notice, and forfeit privilege over the investigation. Sending immediately without that analysis optimizes for public relations while the company is still unsure what it is legally required to say. Waiting for a final forensic report is a common instinct but will usually blow statutory deadlines, which do not pause for investigative completeness. Card brand and acquirer notification is a genuine contractual duty, yet those parties do not determine the company's obligations to regulators or to consumers.

   Source: NIST SP 800-61 Rev. 2, Computer Security Incident Handling Guide

8. Question 8 · Software Development Security

   Roughly a third of an insurance carrier's merged code is now AI assistant generated. Counsel worries about license contamination and the CISO about defect density, while engineering says a ban would be unenforceable. What is the BEST first governance step?

   1. AExtend the existing secure development policy and pipeline checks to cover assistant generated code
   2. BRequire developers to label assistant generated code in commit messages so that it can be tracked
   3. CPurchase an enterprise tier of the assistant that offers indemnification against third-party license claims
   4. DProhibit use of the assistant until a formal tool evaluation and legal review have been completed
   Show answer and explanation

   Correct answer

   Extend the existing secure development policy and pipeline checks to cover assistant generated code

   Code is code regardless of who or what produced it, so the governance step that scales is to extend the existing secure development policy, review requirements and automated pipeline checks to cover assistant generated code, adding the license and provenance verification that general counsel needs. A ban that engineering says is unenforceable creates an unmanaged shadow practice with no visibility at all. Labeling commits produces useful telemetry but attaches no control to the code itself. An indemnifying enterprise tier transfers some legal risk and is worth negotiating, yet it does nothing about defect density and does not establish how the code gets reviewed.

   Source: NIST SP 800-218: Secure Software Development Framework (SSDF) Version 1.1