CISSP

One question per exam domain, 8 in all, each with the answer, the reasoning behind it, and the public source it was written from. Read them here with no account. These are original questions written against the published exam outline, not real exam items.

1. Question 1 · Security and Risk Management

   A county gives the same 30-minute annual awareness module to all 3,000 employees. Phishing results have been flat for two years, and developers say the content is irrelevant. What would MOST improve the program?

   1. ATie completion of the annual module to performance reviews so employees pay more attention.
   2. BAdd role-based training on each job function's specific risks, layered on the common baseline.
   3. CReplace the annual module with a monthly micro-learning series for all staff to improve retention.
   4. DMove phishing simulations from quarterly to monthly so practice is more regular.
   Show answer and explanation

   Correct answer

   Add role-based training on each job function's specific risks, layered on the common baseline.

   General awareness establishes a common baseline, but people change behavior when the content maps to decisions they actually make, and a developer maintaining a public portal faces secure coding and dependency risks that a generic module never touches. Layering role-based training on the baseline addresses both the flat results and the relevance complaint, and it reaches roles such as finance and privileged administrators whose mistakes carry the most impact. Monthly phishing simulations increase exposure to one attack vector and, delivered too often, produce fatigue and gaming of the test rather than improved judgment. A monthly micro-learning series improves cadence and retention, which is a real benefit, but delivering the same irrelevant content in smaller pieces does not solve the relevance problem. Tying completion to performance reviews raises the completion rate, which is already high, and completion has never been the constraint here.

   Source: NIST SP 800-50 Rev. 1: Building a Cybersecurity and Privacy Learning Program

2. Question 2 · Asset Security

   A genomics institute ships weekly backup tapes offsite by courier, and one shipment holding sequencing data traceable to named participants was lost in transit. Which control would MOST reduce the impact of a recurrence?

   1. ASplit each backup across two tapes shipped on separate days so that no single lost shipment is complete.
   2. BMove to a courier that provides GPS-tracked custody and signature capture at every handoff in the custody chain.
   3. CRequire dual-person integrity at every handoff along with a signed manifest reconciled at the vault.
   4. DEncrypt the backup media before it leaves the facility, with keys held separately and never shipped with it.
   Show answer and explanation

   Correct answer

   Encrypt the backup media before it leaves the facility, with keys held separately and never shipped with it.

   The concern here is impact rather than likelihood, and encrypting the media with keys held separately means a lost tape becomes an inventory problem instead of a disclosure of identifiable participant data. That protection holds regardless of who loses the tape or how. A tracked courier lowers the chance of loss and speeds recovery, but a tape that does go missing is still readable, so the worst case is unchanged. Splitting a backup across two shipments reduces how much is exposed at once while still exposing identifiable records, and it doubles the number of shipments that can go astray. Dual-person integrity and a reconciled manifest tighten chain of custody and would detect the loss sooner, which again addresses likelihood and detection rather than the consequence of an unprotected tape in a stranger's hands.

   Source: NIST SP 800-111: Guide to Storage Encryption Technologies for End User Devices

3. Question 3 · Security Architecture and Engineering

   A national laboratory's mandatory confidentiality policy forbids writes to a lower classification, so scientists cannot publish sanitized summaries. The director wants it relaxed. As the architect, what is the BEST response?

   1. ACreate a controlled downgrade path run by an authorized trusted subject, with review and audit of each release
   2. BKeep the control unchanged and have scientists retype printed extracts into the unclassified environment
   3. CGrant scientists a standing exception to write downward when they attest the content is sanitized
   4. DLower the source repositories' classification so publishing a summary is no longer a downward write
   Show answer and explanation

   Correct answer

   Create a controlled downgrade path run by an authorized trusted subject, with review and audit of each release

   A mandatory confidentiality model anticipates this exact tension and resolves it with a trusted subject: a limited, authorized entity permitted to perform a downgrade under review, so the policy holds for everyone else while the mission need is met through an accountable path. Granting every scientist a standing attestation-based exception is the fastest answer and it is how many organizations quietly fail, because it converts a mandatory control into a discretionary one and removes the independent check that catches an honest sanitization mistake. Reclassifying source repositories downward resolves the symptom by discarding the protection the classification represented. Directing scientists to retype printed extracts leaves the control formally intact while creating an unmonitored transfer channel with no review, which is worse than the sanctioned downgrade because nothing is recorded.

   Source: NISTIR 7316: Assessment of Access Control Systems

4. Question 4 · Communication and Network Security

   A media company plans to run block storage traffic over the same switching fabric as its workstations and rendering nodes, using a converged protocol. Before purchase, which security concern should you raise FIRST?

   1. AThe company should keep a separate physical fabric for storage, because converged designs cannot adequately secure block traffic
   2. BStorage protocols on a shared fabric assume a trusted transport, so the design needs initiator authentication and isolated flows
   3. CStorage traffic should be compressed at the initiator so it takes a smaller share of the shared fabric during peaks
   4. DStorage traffic will consume bandwidth the rendering nodes need, so the fabric must be sized for peak simultaneous load
   Show answer and explanation

   Correct answer

   Storage protocols on a shared fabric assume a trusted transport, so the design needs initiator authentication and isolated flows

   Converged designs are perfectly defensible, but the storage protocols riding on them were built for a dedicated fabric and generally assume the transport is trusted, so the security conversation must be about initiator authentication and enforced isolation of the storage flows. Raising that first steers the purchase toward a design that can be secured rather than one that is retrofitted. Capacity planning for peak load is a legitimate and necessary engineering concern, and it addresses availability rather than the trust assumption. Compression at the initiator is an optimization with no bearing on who is permitted to attach to a target. Declaring that converged fabrics cannot be secured is an overstatement that the vendor will rightly rebut, and overstating a risk costs credibility on the points that actually matter.

   Source: NIST SP 800-209: Security Guidelines for Storage Infrastructure

5. Question 5 · Identity and Access Management (IAM)

   A native mobile app embeds its client secret in the binary, shows the login screen in an embedded web view, and receives the authorization code via a custom URL scheme. Which change BEST reduces credential and code theft?

   1. AObfuscate the binary so the embedded client secret cannot be recovered by decompiling the app
   2. BPin the authorization server's certificate in the app to prevent interception of the authorization code
   3. CUse the authorization code flow with a proof key through the system browser, as a public client
   4. DSwitch to a grant in which the app collects the user's password directly, so no redirect is involved at all
   Show answer and explanation

   Correct answer

   Use the authorization code flow with a proof key through the system browser, as a public client

   Anything shipped inside an installed application is public by definition, so the correct posture is to stop pretending the client can hold a secret and instead bind the authorization code to the instance that requested it using a proof key. Using the system browser rather than an embedded web view also stops the application from seeing the user's credentials and lets the user verify the real address bar. Obfuscation delays extraction of a secret that remains recoverable and leaves the code interception path open. Certificate pinning protects the transport but not the redirect, which is where a malicious application registering the same custom scheme steals the code. Collecting the password directly in the application is the pattern current guidance explicitly discourages, because it trains users to hand credentials to third-party software.

   Source: RFC 8252: OAuth 2.0 for Native Apps

6. Question 6 · Security Assessment and Testing

   A county has 60 findings from an external assessment across property tax, elections and public works systems, and the county administrator has funded roughly a third of the remediation this year. As security manager, what should you do FIRST?

   1. ARemediate every finding on the elections support systems, since public trust in elections is the county's most sensitive concern
   2. BAsk the external assessor to rank the findings, since the assessor is independent and knows each one best
   3. CAssess each finding's likelihood and mission impact, then present a prioritized remediation plan to the administrator
   4. DRemediate the lowest-cost findings first, so the largest number of items close within the available funding
   Show answer and explanation

   Correct answer

   Assess each finding's likelihood and mission impact, then present a prioritized remediation plan to the administrator

   Control selection and remediation sequencing follow from risk, so the first step is to assess likelihood and mission impact and then bring management a prioritized plan, since accepting the residual risk on the unfunded remainder is a decision the administrator must make and own. Concentrating everything on elections systems may well be where the analysis lands, but choosing the destination before performing the analysis leaves the other two mission areas unexamined. Optimizing for cheapest-first maximizes the count of closed findings and looks productive in reporting while potentially leaving the highest-impact exposures untouched. Asking the assessor to rank is tempting given their technical depth, but the assessor does not own the county's mission priorities or risk tolerance and should not be making acceptance decisions.

   Source: NIST SP 800-30 Rev. 1, Guide for Conducting Risk Assessments

7. Question 7 · Security Operations

   An Ohio retailer confirms an attacker accessed order records for customers in the United States, Germany, and Brazil. Containment is complete, and the marketing officer wants a customer email sent within the hour. What is the BEST next step?

   1. AEngage legal counsel to determine which jurisdictions apply, what each requires, and what the notice must contain
   2. BNotify the card brands and acquiring bank first, then decide on customer notification based on their guidance
   3. CSend the notification now, since prompt transparency limits reputational harm and regulators favor early disclosure
   4. DHold all notification until the forensic investigation delivers a final report so the message is complete and accurate
   Show answer and explanation

   Correct answer

   Engage legal counsel to determine which jurisdictions apply, what each requires, and what the notice must contain

   Breach notification is a legal obligation whose deadlines, required content, and recipients differ by jurisdiction, and three sets of residents here implicate three different regimes with different clocks. Counsel determines those obligations, and an uncoordinated communication can create admissions, contradict a later required notice, and forfeit privilege over the investigation. Sending immediately without that analysis optimizes for public relations while the company is still unsure what it is legally required to say. Waiting for a final forensic report is a common instinct but will usually blow statutory deadlines, which do not pause for investigative completeness. Card brand and acquirer notification is a genuine contractual duty, yet those parties do not determine the company's obligations to regulators or to consumers.

   Source: NIST SP 800-61 Rev. 2, Computer Security Incident Handling Guide

8. Question 8 · Software Development Security

   An AI coding assistant now generates roughly a third of an insurance carrier's merged code. Counsel worries about license contamination and the CISO about defect density; engineering says a ban would be unenforceable. What is the BEST first governance step?

   1. AExtend existing secure development policy and pipeline checks to assistant-generated code
   2. BRequire developers to label assistant-generated code in commit messages for tracking
   3. CPurchase an enterprise tier of the assistant with indemnity against third-party license claims
   4. DProhibit the assistant until a formal tool evaluation and legal review are complete
   Show answer and explanation

   Correct answer

   Extend existing secure development policy and pipeline checks to assistant-generated code

   Code is code regardless of who or what produced it, so the governance step that scales is to extend the existing secure development policy, review requirements and automated pipeline checks to cover assistant-generated code, adding the license and provenance verification that general counsel needs. A ban that engineering says is unenforceable creates an unmanaged shadow practice with no visibility at all. Labeling commits produces useful telemetry but attaches no control to the code itself. An indemnifying enterprise tier transfers some legal risk and is worth negotiating, yet it does nothing about defect density and does not establish how the code gets reviewed.

   Source: NIST SP 800-218: Secure Software Development Framework (SSDF) Version 1.1