ISC2 CISSP Practice Test 2026-2027 and Free Sample Questions

The three core principles of the security triad that information security programs are designed to protect are:

An organization assigns sensitivity labels such as confidential and public to its data so that appropriate handling controls can be applied. This practice is known as:

A security design principle states that a subject should be granted only the minimum access rights necessary to perform its job functions. This principle is known as:

An attacker sends forged Address Resolution Protocol messages on a local network to associate the attacker's MAC address with the IP address of the default gateway. This attack is best described as:

A system requires a user to present a password and a one-time code from a hardware token. This authentication approach combines something the user knows and something the user has, which is an example of:

A security team conducts an authorized simulated attack against its own network to identify exploitable vulnerabilities before real attackers do. This activity is called:

An organization keeps three copies of its data on two different media types with one copy stored offsite. This widely recommended backup approach is known as the:

A web application fails to validate user input, allowing an attacker to insert malicious database commands into a query. The vulnerability the attacker exploits is:

When the cost of implementing a safeguard is greater than the expected loss the safeguard prevents, the organization is most likely to choose to:

An organization must permanently destroy data on solid-state drives before disposal so that the data cannot be recovered. The most appropriate method to ensure the data is unrecoverable is:

In an access control model where access decisions are based on the security labels of subjects and objects and are enforced by the system rather than the data owner, the model is:

A cryptographic system uses a pair of mathematically related keys, one public and one private, so that data encrypted with one key can be decrypted only with the other. This describes:

A security device placed between an internal network and the internet that filters traffic based on a defined rule set is best described as a:

In incident response, the phase in which the team takes immediate action to limit the scope and spread of an active incident, such as isolating affected systems, is the:

A development team integrates automated security testing into its continuous integration pipeline so that vulnerabilities are caught early in the build process. This practice reflects the principle of:

A document that outlines how an organization will continue critical business functions during and after a disruptive event is the:

An independent reviewer examines an organization's controls and compares them against a defined standard to determine compliance. This formal evaluation is best described as a:

An employee changes job roles within a company, and their old permissions are never removed, so they accumulate excessive access over time. This common access management problem is called:

A security model architecture in which no user or device is trusted by default and every access request is verified regardless of network location is known as: