CISSP practice examsIn development
Certified Information Systems Security Professional
The CISSP is a globally recognized certification in the field of information security, validating deep technical and managerial competence. It is designed for experienced security practitioners, managers, and executives who design, engineer, and manage an organization's overall security posture. Holding a CISSP demonstrates mastery across eight domains of cybersecurity knowledge and is often required for senior security roles.
What you get
Papers are cut from the bank and weighted like the real exam, and no question appears in two of them. Every wrong answer comes back on later days until you have it right.
What the exam covers
| Security and Risk Management | 15% |
| Asset Security | 10% |
| Security Architecture and Engineering | 13% |
| Communication and Network Security | 13% |
| Identity and Access Management (IAM) | 13% |
| Security Assessment and Testing | 12% |
| Security Operations | 13% |
| Software Development Security | 11% |
Two sample questions
1. A development team is about to release a new version of their application. Before release, they want to verify that the new features haven't broken any existing functionality. They re-run all existing test cases against the new version. What type of testing is this?
- Unit testing of individual components in coordination with relevant stakeholders and technical teams involved
- Regression testing to verify existing functionality still works after changes — correct
- Acceptance testing to verify the application meets business requirements
- Integration testing to verify components work together
Why: The correct answer is D. Regression testing re-executes existing test cases after changes to verify that previously working functionality has not been broken by new code. This is essential before every release. Option A (unit testing) tests individual functions in isolation. Option C (integration testing) verifies that different modules work together. Option D (acceptance testing) validates business requirements with stakeholders.
2. During a risk assessment, the security team identifies that a legacy industrial control system cannot be patched due to vendor support constraints and operational requirements. The system controls critical manufacturing processes. Which risk treatment approach is MOST appropriate?
- Risk avoidance by immediately shutting down the legacy system and halting manufacturing until a replacement is procured
- Risk mitigation by implementing compensating controls such as network isolation, enhanced monitoring, and application whitelisting — correct
- Risk acceptance by documenting the vulnerability and continuing operations without any additional protective measures
- Risk transfer by outsourcing the operation of the industrial control system to a third-party managed service provider
Why: Compensating controls provide risk mitigation when the preferred control (patching) is not feasible. Network isolation limits the attack surface, enhanced monitoring detects suspicious activity, and application whitelisting prevents unauthorized code execution. Shutting down critical manufacturing is disproportionate. Outsourcing does not eliminate the technical vulnerability. Accepting the risk without compensating controls is irresponsible for a critical system with known vulnerabilities.
The real CISSP exam
| Length | 4 hours |
|---|---|
| Questions | 125-175 (CAT format) |
| Pass mark | 700/1000 |
| Price | $749 |
| Recommended before you sit it | Minimum 5 years cumulative paid work experience in 2 or more of the 8 CISSP domains. A 4-year college degree or approved credential satisfies 1 year of experience. |
| Valid for | 3 years |
Exam facts as published by (ISC)²; always check the vendor’s page before you book.
Study CISSP with Chiron
Chiron is invitation-only while we are in beta, and nothing is for sale yet: invited accounts use every paper, drill and course note for free.