Free CISSP practice questions

Which statement BEST describes the relationship between the ISC2 Code of Professional Ethics canons and an employer's internal code of conduct for a CISSP-certified employee?

• AThe ISC2 canons apply to certified professionals at all times and complement, rather than replace, lawful employer codes of conduct.check_circle Correct
• BThe employer's code of conduct overrides the ISC2 canons whenever the two appear to conflict in the workplace.
• CThe ISC2 canons only apply when the CISSP is performing security work outside of normal employment duties.
• DEither code can be ignored provided the professional acts in line with applicable national law and contractual obligations.

Why A is correct: The canons bind the certificant personally and continuously, while a lawful employer code governs workplace duties; the two are designed to coexist, with the canons providing the professional baseline.

Why B is wrong: Tempting because employees normally follow employer policy, but a CISSP holder agreed to uphold the ISC2 canons as a condition of certification, so the canons are not displaced by internal policy.

Why C is wrong: Plausible to a candidate who thinks ethics codes only cover voluntary or external activity, but the canons attach to the certificant in every professional context, not only off-hours engagements.

Why D is wrong: Compliance with law is necessary but not sufficient; the ISC2 canons impose duties beyond legal minimums, and ignoring an employer's lawful code breaches duty owed to principals.

A CISSP must resolve a conflict between two canons of the ISC2 Code of Professional Ethics. Which ordering of the canons reflects the precedence stated by ISC2 when canons appear to conflict?

• AAct honourably first, then advance the profession, then provide diligent service, then protect society.
• BProtect society and the common good first, then act honourably, then provide diligent service to principals, then advance the profession.check_circle Correct
• CProvide diligent and competent service to principals, then protect society, then act honourably, then advance the profession.
• DAdvance and protect the profession first, then protect society, then provide diligent service, then act honourably.

Why A is wrong: Tempting because personal honour feels foundational, but ISC2 lists protection of society and the common good as the first canon, ahead of personal honour.

Why B is correct: This matches the canon order published by ISC2, which is also the precedence used when canons conflict: society, honour, service to principals, then the profession.

Why C is wrong: Service to the employer or client feels primary day to day, yet ISC2 places duty to society above duty to principals when canons conflict.

Why D is wrong: Putting the profession first appears self-interested and is not the ISC2 ordering; the profession is the fourth canon, not the first.

An organisation's information security policy requires staff to exercise due care. Which description BEST captures what due care means for a CISSP performing day-to-day duties?

• AInvestigating threats and control options thoroughly before recommending or approving any safeguard for the organisation.
• BDocumenting every control decision in a register that is reviewed by the audit committee before implementation.
• CTaking the reasonable and prudent actions a similarly qualified professional would take to protect organisational assets and stakeholders.check_circle Correct
• DFollowing written security procedures exactly as published, without exercising professional judgement in unusual situations.

Why A is wrong: Strong investigation before recommending controls is due diligence, the research that supports a decision, rather than due care, which is the prudent action that follows it.

Why B is wrong: Audit-ready documentation supports accountability and governance, but the substance of due care is the prudent act itself, not the existence of a register reviewed by a committee.

Why C is correct: Due care is the reasonable-person standard applied to a security professional, meaning the actions a competent peer in the same role would take given what was known at the time.

Why D is wrong: Procedural compliance is part of being diligent, but due care expects the professional to apply judgement when circumstances depart from the standard procedure, not to follow text rigidly.

A security architect is briefing a board on the difference between defence in depth and zero trust as guiding design principles for a new corporate platform. Which statement BEST captures the conceptual distinction between the two?

• ADefence in depth layers independent controls so that the failure of any single control does not breach the asset, whereas zero trust removes implicit trust based on network location and continuously verifies each subject, device, and request.check_circle Correct
• BDefence in depth is a network segmentation technique that encrypts traffic between tiers, while zero trust is a procurement requirement that all suppliers attest to their secure software development practices.
• CDefence in depth replaces perimeter firewalls with identity-aware proxies, while zero trust focuses on encrypting data at rest and in transit at every storage tier.
• DDefence in depth and zero trust are interchangeable terms describing layered authentication, with defence in depth being the older vendor label and zero trust being the modern one.

Why A is correct: This correctly frames defence in depth as a layered-controls strategy whose value is failure tolerance, while zero trust is a trust model that replaces network-perimeter assumptions with per-request verification of identity, device posture, and context.

Why B is wrong: This is tempting because both ideas are often discussed alongside segmentation and supply-chain trust, but defence in depth is a broader layered-controls strategy not limited to network segmentation, and zero trust is a security model rather than a procurement clause.

Why C is wrong: This inverts the two concepts: identity-aware proxies are typical of zero trust enforcement, and ubiquitous encryption is a cryptographic control rather than the essence of either principle.

Why D is wrong: Candidates sometimes treat the terms as synonyms because both involve multiple checks, but they describe different ideas: layered independent controls versus an architectural trust model with no implicit network trust.

During a design review, a junior engineer proposes shipping a new internal collaboration tool with anonymous access enabled, file sharing open to the public internet, and verbose error messages turned on, arguing that hardening can be applied later once users provide feedback. Which secure design principle is the engineer MOST directly violating?

• ASeparation of duties, because a single engineer should not be permitted to change both the access configuration and the error reporting configuration of the same component.
• BSecure defaults, because the system as designed grants the most permissive posture out of the box and relies on later tightening rather than starting in the most restrictive state.check_circle Correct
• CLeast privilege, because the engineer is granting administrative rights to the collaboration tool when read-only rights would suffice for most users.
• DDefence in depth, because the engineer has chosen a single control point at the application layer instead of layering controls at the network, host, and application layers.

Why A is wrong: Separation of duties addresses collusion risk by splitting sensitive tasks between people, which is a procedural control rather than the design choice about default posture being described here.

Why B is correct: Secure defaults requires that an unconfigured system be in its safest state. Open anonymous access, public sharing, and verbose errors are the opposite: a permissive baseline that depends on later hardening, which is precisely what the principle forbids.

Why C is wrong: Least privilege concerns the rights granted to a specific subject for a specific task. The scenario describes the system's default exposure rather than the rights assigned to a defined role, so the better fit is secure defaults.

Why D is wrong: Defence in depth is about layering independent controls. The issue here is not the absence of layers but that the baseline configuration is permissive, which maps more precisely to the secure defaults principle.

A privacy lead is mapping the seven foundational principles of privacy by design onto a new customer onboarding platform. Which characterisation of the principle 'privacy as the default setting' is MOST accurate?

• AThe platform must obtain explicit consent before any personal data is collected, regardless of whether the processing has a separate lawful basis under data protection law.
• BThe platform must encrypt personal data both at rest and in transit using approved algorithms before the system is permitted to enter production.
• CThe platform must provide the user with the maximum degree of privacy automatically, so that even if the user does nothing their personal data remains protected and minimally processed.check_circle Correct
• DThe platform must give the user a single dashboard from which all privacy preferences can be reviewed and changed at any time during the customer relationship.

Why A is wrong: This conflates the default setting principle with the lawful basis question. Consent is one lawful basis under privacy law but the default setting principle is about what happens when the user does nothing, not which lawful basis applies.

Why B is wrong: Encryption is a useful technical control and supports several privacy outcomes, but it is a cryptographic safeguard rather than the default setting principle, which is about the posture a user receives without taking any action.

Why C is correct: This matches Cavoukian's formulation: privacy as the default means the most privacy-protective settings are applied automatically, so a user who takes no action still receives strong protection without having to opt out of permissive defaults.

Why D is wrong: A preferences dashboard supports transparency and user control, which are other privacy by design principles, but it is not the default setting principle, which speaks specifically to the state of the system when the user has not configured anything.

A security architect is documenting where TLS termination, IPsec encapsulation, and IEEE 802.1X authentication operate so that engineering teams can map controls to the OSI reference model consistently. Which statement correctly attributes these controls to OSI layers?

• ATLS operates at the application layer, IPsec at the transport layer, and 802.1X at the network layer.
• BTLS operates at the transport layer, IPsec at the data link layer, and 802.1X at the physical layer.
• CTLS operates at the presentation layer, IPsec at the session layer, and 802.1X at the network layer.
• DTLS operates between the transport and application layers, IPsec at the network layer, and 802.1X at the data link layer.check_circle Correct

Why A is wrong: This is the most common confusion: candidates remember that TLS protects HTTPS and treat it as application, place IPsec near TCP because of port-style policies, and lift 802.1X from layer 2. Each attribution is wrong because TLS is not an application protocol, IPsec wraps IP packets at layer 3, and 802.1X is a data-link port control.

Why B is wrong: TLS riding directly on TCP makes the transport label tempting, but TLS is not the transport protocol itself. IPsec does not run at layer 2 because it operates on IP packets, and 802.1X authenticates at the port (data link), not at the physical layer where only signalling occurs.

Why C is wrong: Some texts loosely place TLS at presentation, which makes the option look authoritative, but IPsec is never a session-layer protocol because it encapsulates network packets, and 802.1X is a layer 2 control, not a layer 3 one, so the overall mapping is incorrect.

Why D is correct: TLS sits above transport (commonly framed as session or presentation in OSI terms) and shields application payload, IPsec encapsulates at layer 3 and protects IP packets, and 802.1X is a port-based access control at layer 2, which matches how the controls are designed and deployed in practice.

A bank is rebuilding the perimeter for a sensitive payments environment. The architect must choose between traditional VLAN-based segmentation and identity-aware micro-segmentation. Which statement BEST distinguishes micro-segmentation from VLAN segmentation in a defensible design?

• AMicro-segmentation enforces policy per workload identity and on east-west traffic, whereas VLAN segmentation primarily isolates broadcast domains and relies on a separate firewall for inter-VLAN policy.check_circle Correct
• BMicro-segmentation always replaces firewalls and removes the need for an Internet edge filter once it is deployed.
• CMicro-segmentation is implemented only by SDN controllers and cannot be enforced at the host level.
• DMicro-segmentation operates exclusively at layer 2 to isolate broadcast domains for individual virtual machines.

Why A is correct: Micro-segmentation applies fine-grained policy keyed to workload, user, or process identity and inspects lateral traffic between peers in the same broadcast domain, while VLANs create layer 2 broadcast separation and depend on an external layer 3 device to filter between VLANs, which is the load-bearing distinction in design reviews.

Why B is wrong: This is tempting because vendor messaging often positions micro-segmentation as a replacement for perimeter tools, but it complements rather than replaces edge firewalls and IDS. Treating it as a wholesale replacement leaves north-south traffic unprotected and is not the way the control is positioned in CISSP-aligned architectures.

Why C is wrong: Many candidates remember that SDN enables micro-segmentation and conclude the controller is mandatory. In practice host-based agents, hypervisor distributed firewalls, and identity-aware proxies can all enforce micro-segmentation without a centralised SDN fabric, so this option is too narrow.

Why D is wrong: Confining micro-segmentation to layer 2 mirrors how VLANs work and sounds plausible, but micro-segmentation typically inspects layer 3 to layer 7 attributes and is identity-aware, not broadcast-domain-aware, so this description actually re-describes VLANs.

An architect is documenting a software-defined networking deployment for the audit committee. Which statement most accurately describes the security-relevant property of the SDN control plane and data plane separation?

• ASeparating control and data planes removes the need for authentication on the southbound interface because controller commands are trusted by default.
• BSeparating control and data planes centralises policy decisions and makes the controller a high-value target whose compromise can reprogram forwarding behaviour fabric-wide.check_circle Correct
• CSeparating control and data planes guarantees that forwarding decisions are made locally at each switch, eliminating any centralised choke point.
• DSeparating control and data planes mainly improves cable management and has no meaningful effect on the network's trust boundaries.

Why A is wrong: Some candidates assume that an internal fabric link is inherently trusted, but the southbound channel (for example OpenFlow) must be authenticated and ideally TLS-protected; treating it as trusted is exactly the misconfiguration that lets an attacker on the management network rewrite flow tables.

Why B is correct: SDN moves the decision logic into a logically centralised controller and leaves switches as policy enforcers, which simplifies orchestration but concentrates risk: an attacker who subverts the controller or the southbound channel can install forwarding rules across the fabric, so the controller becomes the most sensitive trust anchor in the design.

Why C is wrong: This reverses the architecture: SDN deliberately moves decision making off the switch into a controller, so claiming local decisions and no central choke point describes traditional distributed networking, not SDN.

Why D is wrong: Framing the change as a cabling or operational matter understates the security implication: the controller becomes a new privileged component with its own attack surface, so dismissing the trust-boundary shift is the wrong answer in a security review.

A facilities team is documenting the difference between physical and logical access controls before drafting a new asset protection policy. Which statement best characterises the distinction a CISSP candidate should rely on?

• APhysical controls protect the perimeter of a site, while logical controls protect only the internal network segments behind that perimeter.
• BPhysical controls are preventive in nature, while logical controls are detective in nature and used mainly to support investigations.
• CPhysical controls govern tangible barriers and environmental measures, while logical controls govern software-enforced restrictions on data, systems, and accounts.check_circle Correct
• DPhysical controls are mandatory for regulatory compliance, while logical controls are discretionary measures chosen by data owners.

Why A is wrong: This conflates network segmentation with the broader logical access category. Logical controls cover applications, databases, files, and endpoints, not just internal network zones, so the definition is too narrow.

Why B is wrong: Both categories include preventive, detective, deterrent, and corrective examples. Treating physical as purely preventive and logical as purely detective misrepresents how control functions are classified.

Why C is correct: This captures the canonical CISSP distinction: physical controls (fences, guards, mantraps, locks) protect tangible assets and the environment, while logical controls (permissions, ACLs, MFA, encryption) enforce access in software.

Why D is wrong: Regulatory regimes mandate both categories where appropriate, and discretionary access control is a specific logical model, not a description of the whole category, so this framing is incorrect.

An organisation classifies its security controls by function for an internal audit. A mantrap that physically prevents tailgating into a server room is BEST described as which control type?

• AA detective physical control that records each individual passage for later review by security staff.
• BA deterrent administrative control that discourages tailgating through visible reminders to authorised employees on entry.
• CA compensating logical control that substitutes for missing badge-reader integration at the entry point to the server room.
• DA preventive physical control that stops unauthorised individuals from following an authorised person into a protected area.check_circle Correct

Why A is wrong: Recording entries is a detective function, but the mantrap's defining purpose is to physically stop a second person from following an authorised user, which is a preventive function rather than a detective one.

Why B is wrong: Administrative controls are policies, procedures, and training. A mantrap is a physical barrier that actively interlocks doors, not a written reminder, so the category and function are both wrong.

Why C is wrong: Logical controls operate within information systems through software enforcement. A physical interlock between two doors is not a logical control and is not acting as a substitute for a software mechanism.

Why D is correct: A mantrap interlocks two doors so only one person can transit at a time. It physically prevents tailgating before it happens, which is the textbook example of a preventive physical control.

While reviewing access mechanisms for a new application, an analyst is asked to identify which item is a logical access control rather than a physical one. Which option fits that description?

• AAn access control list on a file share that permits read access to one group and denies access to all others.check_circle Correct
• BA turnstile at the building entrance that releases only when a valid employee badge is presented to a reader.
• CA guard who inspects identification at the loading dock before allowing vehicles or contractors to enter the site.
• DA reinforced cage around a wiring closet that limits who can reach the cabling and network distribution panels.

Why A is correct: An access control list is enforced by the operating system or application against authenticated subjects. It mediates logical access to information assets and is the canonical example of a logical access control.

Why B is wrong: A turnstile is a tangible barrier that constrains physical passage into a facility. Even though it is triggered by a badge reader, the control itself acts on a person's movement and is therefore physical.

Why C is wrong: A guard performing identity checks at a loading dock is enforcing physical access to a facility. The control is human and physical, not a software-enforced restriction on information assets.

Why D is wrong: A locked cage restricts physical contact with equipment and cabling. It is a physical access control protecting the device layer, not a logical mechanism inside an information system.

A security analyst at a financial services firm receives an alert that a senior trader's workstation has been communicating with a known command-and-control domain. Counsel has indicated that the matter is likely to result in civil litigation against a former employee. The workstation is still powered on and the user is at lunch. What should the analyst do FIRST?

• APull the network cable to contain the threat and then image the disk using a write-blocker before counsel arrives on site.
• BNotify the incident commander and legal counsel, then acquire volatile data and a forensic image under documented chain of custody following the firm's incident response plan.check_circle Correct
• CLog on to the workstation with the trader's account to triage running processes and copy suspicious files to a network share for the forensic team.
• DReimage the workstation from the gold build to eradicate the malware and restore productivity, then escalate the indicators of compromise to the threat intelligence team.

Why A is wrong: Containment instinct is reasonable, but unilaterally yanking the cable can alert malware to wipe artefacts, destroys volatile state needed for litigation, and bypasses the documented incident response and legal hold workflow that counsel must drive.

Why B is correct: The correct manager-led action is to engage the incident commander and counsel so a legal hold can be invoked, then capture volatile evidence and a forensic image with chain of custody intact, preserving admissibility for the anticipated litigation.

Why C is wrong: Logging in as the user contaminates the evidence by writing new timestamps, swapping memory pages and modifying registry hives, and copying files over SMB destroys metadata that a defensible image would have preserved.

Why D is wrong: Reimaging is an eradication step that must come after evidence preservation; doing it first destroys the disk artefacts and volatile memory that counsel and any subsequent civil action depend on.

A forensic examiner has acquired a suspect's encrypted laptop while it is still powered on and logged in. The disk is protected by full-disk encryption with a TPM-bound key that the user cannot disclose. The examiner has thirty minutes before the on-site window closes. Which acquisition strategy BEST balances completeness against the risk of losing access to the data?

• AShut the laptop down cleanly so that disk caches flush, then transport it to the lab and image the drive offline using a hardware write-blocker.
• BTrigger a forced hibernation so that the encryption key is written to the hibernation file, then image the disk offline and recover the key from the hibernation artefact.
• CCapture volatile memory first, then perform a live logical acquisition of the decrypted file system before the device is powered off or disconnected.check_circle Correct
• DPause the system, attach a USB drive, and copy the user profile and obvious evidence files using the operating system's file explorer to save time on imaging.

Why A is wrong: A clean shutdown re-seals the TPM and clears RAM, leaving the examiner with a ciphertext-only image and no key material; the offline image will be unreadable and the on-site opportunity will have been squandered.

Why B is wrong: Hibernation behaviour depends on the encryption product and platform configuration, and many implementations explicitly purge the key from the hibernation file; relying on this risks losing access entirely and is not a defensible primary plan.

Why C is correct: Because the volume is currently mounted and decrypted, memory and a live logical acquisition expose the plaintext content and may yield the key in RAM; this is the only path that preserves the data the suspect cannot be compelled to disclose.

Why D is wrong: Copying via the operating system updates access times, ignores unallocated space, slack and journals, and is not a forensically sound acquisition; it would also fail the chain-of-custody and completeness expectations of any tribunal.

During an internal investigation into suspected intellectual property theft, an examiner discovers that the suspect's mailbox is hosted in a cloud productivity suite and that retention policies will purge deleted items in seven days. The general counsel has placed the suspect on a legal hold. What is the MOST appropriate next step for the examiner?

• AExport the suspect's mailbox to a PST file from the examiner's own administrative account and store it on the case share for later review.
• BInstruct the suspect's manager to quietly disable the suspect's account so that no further deletions occur while the investigation proceeds.
• CIssue a written preservation notice to the cloud provider asking them to freeze the tenant data while the legal team prepares a formal subpoena.
• DApply an in-place hold or preservation policy through the tenant's eDiscovery tooling so that all mailbox content is retained in place pending collection.check_circle Correct

Why A is wrong: Ad hoc PST export from a personal admin account leaves no audit trail tying the action to the legal hold, breaks chain of custody, and risks altering message metadata such as read flags and folder paths during export.

Why B is wrong: Disabling the account does not stop tenant retention policies from purging already-deleted items, may tip off the suspect when access fails, and pulls the line manager into an investigation in a way that risks confidentiality and procedural fairness.

Why C is wrong: A unilateral preservation letter to a provider for a customer-controlled tenant is unnecessary and slow; the customer already controls the relevant retention levers and should use them rather than waiting on the provider.

Why D is correct: Using the tenant's native eDiscovery preservation invokes provider-side retention that survives user deletion and retention policy purges, is auditable, and preserves original metadata until a defensible collection can be scoped and exported.

An organisation is drafting its annual security assessment strategy and wants to distinguish a security assessment from a security audit so the right activity is scoped for each engagement. Which statement BEST captures the conceptual difference between these two activities?

• AAn assessment is always performed by external parties for regulatory reasons, whereas an audit is always performed internally by the security function for management oversight.
• BAn assessment evaluates the overall effectiveness of controls against stated objectives, whereas an audit verifies conformance to a defined standard or policy and produces formal evidence of compliance.check_circle Correct
• CAn assessment uses automated scanning tools while an audit relies exclusively on interviews and document review, with no overlap in technique.
• DAn assessment is concerned with detecting vulnerabilities and an audit is concerned with detecting fraud, so the two engagements rarely share scope or stakeholders.

Why A is wrong: Tempting because external assessors and internal auditors are common patterns, but the distinction is incorrect: assessments can be internal and audits can be external. Independence and scope are separate from the assessment-versus-audit distinction.

Why B is correct: Correct. Assessments are broader, advisory engagements that judge whether controls achieve risk-management goals, while audits are evidence-driven exercises that test conformance to a specific baseline such as ISO 27001 or an internal policy and yield an attestation.

Why C is wrong: Plausible because assessments often involve scanners and audits often involve interviews, but both activities can use a mix of automated and manual techniques. The defining difference is purpose and evidentiary rigour, not toolset.

Why D is wrong: Conflates security assessment with vulnerability assessment and audit with financial fraud detection. Security audits cover control conformance broadly, and assessments examine more than vulnerabilities; the framing is too narrow.

A security manager is explaining to executive leadership why the internal audit function must be organisationally independent from the IT and security teams whose controls it tests. Which statement BEST describes the conceptual basis for that independence?

• AIndependence ensures auditors hold professional certifications, which is the primary criterion regulators consider when accepting audit findings.
• BIndependence allows internal auditors to bypass change-management and access-control procedures so they can collect evidence faster than other reviewers.
• CIndependence reduces the risk of self-review and management influence over findings, so the audit opinion can be relied on as an objective view by the board and external stakeholders.check_circle Correct
• DIndependence is required because internal auditors must always replace external auditors in highly regulated industries to satisfy statutory testing obligations.

Why A is wrong: Plausible because certifications such as CIA or CISA are valued, but credentials do not establish independence. Regulators and standards bodies treat independence as a structural property of the reporting line, not a function of who holds which certificate.

Why B is wrong: A common misconception that independence equals exemption from controls. Auditors are subject to the same access and change procedures; independence concerns reporting structure and objectivity, not procedural bypass.

Why C is correct: Correct. The conceptual core of audit independence is freedom from self-review threats and from management pressure on findings. Reporting administratively to management but functionally to the audit committee preserves objectivity and reliability of the opinion.

Why D is wrong: Internal and external audit are complementary rather than substitutes; statutory audits typically still require external assurance. Independence supports reliance on internal work but does not displace external requirements.

A bank is preparing a third-party assurance strategy for its critical SaaS payroll provider. The CISO is comparing a SOC 2 Type II report with the right to perform an on-site audit clause that exists in the contract. Which statement BEST reflects how these two assurance options compare conceptually?

• AA SOC 2 Type II is a point-in-time design review, while a right-to-audit clause forces the provider to operate under the customer's internal control framework instead of its own.
• BA SOC 2 Type II eliminates the need for any contractual audit rights because the AICPA certifies that the provider has zero residual risk for all customer use cases.
• CA right-to-audit clause is legally enforceable only when no SOC 2 report exists, so the two assurance mechanisms cannot be combined within a single contract.
• DA SOC 2 Type II provides operating-effectiveness evidence across a period and is efficient for many customers to consume, while the right-to-audit clause supports targeted, customer-specific testing where the standard report does not cover a residual risk.check_circle Correct

Why A is wrong: Confuses Type I with Type II; Type II covers operating effectiveness across a period. A right-to-audit clause does not subordinate the provider to the customer's framework; it grants access to evidence, not control over the provider's policies.

Why B is wrong: Tempting because SOC 2 carries weight, but it is an attestation under AICPA standards, not a zero-risk certification, and its scope rarely matches every customer's risk picture. Right-to-audit clauses remain useful for residual risks.

Why C is wrong: There is no such precedence rule. Mature contracts commonly include both, using the SOC 2 as routine evidence and the audit right as an escalation path. The statement misstates how the two mechanisms interact.

Why D is correct: Correct. SOC 2 Type II reports cover design and operating effectiveness over time and scale across many customers. A right-to-audit clause complements the report by enabling bespoke testing of issues or controls not addressed by the standard scope, balancing efficiency and depth.

A multinational manufacturer is establishing a data classification scheme and is debating the difference between data sensitivity and data criticality. Which statement best describes how these two attributes drive different control choices?

• ASensitivity and criticality are interchangeable terms that both express the harm caused by unauthorised disclosure of the data.
• BSensitivity is assigned by the data custodian based on storage cost, while criticality is assigned by the data owner based on regulatory class.
• CSensitivity applies only to structured data in databases, while criticality applies only to unstructured data such as documents and media files.
• DSensitivity reflects the impact if confidentiality is lost, while criticality reflects the impact on the business if the asset becomes unavailable or corrupted.check_circle Correct

Why A is wrong: This conflates the two concepts. Many candidates treat the words as synonyms because both relate to impact, but sensitivity speaks to disclosure harm while criticality speaks to availability and operational impact.

Why B is wrong: Both attributes are owner-led judgements aligned to business impact, not storage cost or regulatory class alone. Candidates may confuse this with role responsibilities, but classification ownership rests with the data owner in both cases.

Why C is wrong: Both attributes apply to any information asset regardless of structure. The structured or unstructured nature affects discovery and tagging mechanisms, not the attribute itself.

Why D is correct: Sensitivity is a confidentiality concept used to determine handling and labelling controls, whereas criticality is an availability and integrity concept used to drive recovery objectives and resilience controls. The two attributes can differ for the same asset.

An information security manager is briefing executives on the difference between data classification and asset classification within the new information security policy. Which statement most accurately captures the relationship between them?

• AData classification establishes the sensitivity and criticality of information, and asset classification ensures the systems, media, and components that handle that information receive at least equivalent protection.check_circle Correct
• BAsset classification is performed first and the resulting label is automatically inherited by every data set processed on that asset.
• CData classification is a regulatory obligation while asset classification is a purely voluntary engineering exercise without compliance relevance.
• DData classification covers personal information only, while asset classification covers everything else including intellectual property and trade secrets.

Why A is correct: Data is classified by impact attributes, then asset classification propagates that protection requirement onto the containers, media, and processing components so that controls remain consistent across the whole information lifecycle.

Why B is wrong: Inheritance flows in the opposite direction. Candidates may pick this because hardware is more visible than data, but the asset typically inherits the highest classification of the data it processes, not the other way round.

Why C is wrong: Both activities support regulatory and contractual obligations such as data protection law and PCI DSS scoping. The distinction between mandatory and voluntary here is invented and would mislead any audit conversation.

Why D is wrong: Data classification covers all information types including intellectual property and operational data, not just personal data. This option blends a privacy mindset with classification and is a common misconception.

A financial services firm is reviewing its four-tier data classification scheme (public, internal, confidential, restricted). The risk committee asks which factor should be the PRIMARY input when deciding the label for a new data set. Which factor best fits CISSP guidance?

• AThe storage volume of the data set and the cost of the underlying media used to retain it.
• BThe potential business impact if the confidentiality, integrity, or availability of the data is compromised.check_circle Correct
• CThe technical format of the data, such as whether it is held in a relational database, a flat file, or an object store.
• DThe age of the data set, since older information is presumed to carry lower sensitivity than recently created data.

Why A is wrong: Storage cost is an operational consideration that may influence retention tiering but does not express the business impact of disclosure or loss. Candidates may pick this when conflating data lifecycle management with classification.

Why B is correct: Classification is a business impact judgement. The owner assesses what harm would arise to the organisation, its customers, or third parties if the CIA properties were violated, and assigns the label that drives commensurate controls.

Why C is wrong: Technical format affects discovery, tagging, and tooling but is irrelevant to the classification decision itself. This is a common trap for candidates who think in engineering rather than risk terms.

Why D is wrong: Age is not a primary criterion. Historical records may retain high sensitivity, while some recent operational data may be low sensitivity. Age can inform retention and declassification reviews but not the initial label.

A security architect is explaining to a delivery manager why the organisation is moving from a quality gate at the end of the release pipeline to embedding security activities throughout each SDLC phase. Which statement BEST captures the underlying principle of this shift-left approach?

• AIdentifying security defects in the phase that introduced them lowers remediation cost and prevents flawed assumptions from propagating into later phases.check_circle Correct
• BConcentrating security review at the release gate is preferable because defects can be triaged once the system is feature-complete and behaviour is stable.
• CRunning automated penetration testing against production replicas is the most efficient way to remove vulnerabilities before customers see them.
• DOutsourcing security testing to an independent third party removes bias and provides a defensible assurance artefact for auditors.

Why A is correct: This is the canonical rationale for shift-left: defect-removal economics worsen the further a flaw travels, and design-level errors found in coding or testing are expensive to unwind. Embedding requirements, threat modelling, and secure coding reviews in each phase contains that cost.

Why B is wrong: This describes the legacy waterfall posture the team is moving away from. Late discovery raises remediation cost and forces risk-based exceptions to meet release dates, which is exactly the failure shift-left is meant to address.

Why C is wrong: Pen testing against a production-like environment is valuable, but it happens late and finds only what survives earlier phases. It is a verification activity, not the principle that drives integrating security across the SDLC.

Why D is wrong: Independent assessment supports assurance but does not address when in the lifecycle security is considered. A late third-party test still inherits the cost curve that shift-left is intended to flatten.

A CISO is comparing BSIMM with the OWASP Software Assurance Maturity Model (SAMM) before recommending one to the board as the basis for a software security improvement programme. Which statement BEST describes the difference in how the two models are constructed?

• ABSIMM measures application runtime behaviour during penetration tests, while SAMM measures static code quality through automated tooling.
• BBSIMM is a descriptive model derived from observed activities across participating firms, whereas SAMM is a prescriptive framework that defines target practices and maturity levels.check_circle Correct
• CBoth models are prescriptive, but BSIMM is aligned to ISO 27034 while SAMM is aligned to NIST SP 800-53.
• DSAMM is a closed proprietary benchmark sold to member firms, whereas BSIMM is released openly under a Creative Commons licence.

Why A is wrong: Neither model is a testing tool. Both describe organisational software security programmes rather than runtime or static analysis findings. A candidate who confuses maturity models with assessment tools picks this.

Why B is correct: BSIMM is explicitly an observational instrument: its content is a measurement of what real firms actually do, summarised into a software security framework. SAMM, by contrast, prescribes business functions, security practices, and maturity levels an organisation should aim for. This is the textbook distinction.

Why C is wrong: BSIMM is descriptive, not prescriptive, and neither model is formally aligned to those standards in the way described. The framework attributions in this option are invented and a candidate should reject them.

Why D is wrong: This reverses the openness story: SAMM is the openly published OWASP model, and BSIMM publishes its report openly while drawing data from participating firms. Candidates relying on vague impressions of vendor backing pick this.

During a post-incident review, an auditor asks the development manager which DevSecOps practice MOST directly enforces that no unauthorised or unreviewed change reaches production, regardless of the developer who proposed it. Which practice should the manager identify?

• ABranch protection rules that require peer code review and signed commits before a merge to the release branch is permitted.
• BMandatory secure coding training for all engineers, refreshed annually and tracked through the learning management system.
• CAn immutable, fully automated deployment pipeline whose promotion to production requires a recorded change approval and rejects manually built artefacts.check_circle Correct
• DContinuous vulnerability scanning of production workloads with automated ticketing for findings above a defined CVSS threshold.

Why A is wrong: Peer review and signed commits are strong controls over what enters the codebase, but they sit before the deployment step. A reviewed commit can still bypass production controls if the deployment pipeline itself is not gated, so this is necessary but not the most direct answer to the auditor's question.

Why B is wrong: Training raises the floor of developer capability but is a preventative awareness control, not an enforcement mechanism against unauthorised production change. It would not stop a determined or careless developer from pushing an unapproved artefact.

Why C is correct: An automated pipeline that only accepts artefacts produced by the pipeline itself, coupled with a recorded approval gate for production, enforces separation of duties and change management for every promotion, irrespective of who proposed the change. This is the control closest to the auditor's concern.

Why D is wrong: Runtime scanning detects weaknesses after deployment. It does not prevent an unauthorised or unreviewed change from reaching production in the first place, which is precisely what the auditor is probing.