CISSP Practice Exam: 100 Scenario-Based Questions Across All 8 Domains

Certified Information Systems Security Professional (CISSP) Practice Exam

Prepare for the premier cybersecurity management credential with this rigorous 100-question CISSP practice exam. Designed to reflect the managerial and technical depth of the ISC2 Common Body of Knowledge (CBK), this assessment tests strategic decision-making, security governance, architecture, and threat mitigation.

Comprehensive 8-Domain CBK Coverage

The questions in this exam span all eight official domains tested by ISC2:

• Security and Risk Management (15%): Confidentiality, integrity, availability, security governance, compliance mandates (SOX, FISMA, HIPAA), risk assessment methodologies (OCTAVE, NIST SP 800-30, FAIR), threat modeling (STRIDE), and business continuity management (BIA, MTD, RTO, RPO).
• Asset Security (10%): Data classification schemes, information handling policies, data retention baselines, data states (at rest, in transit, in use), sanitization standards (NIST SP 800-88), and privacy framework alignment.
• Security Architecture and Engineering (13%): Security models (Bell-LaPadula, Biba, Clark-Wilson), security evaluation criteria (Common Criteria, EAL levels), cryptographic systems (symmetric, asymmetric, hashing, digital signatures, PKI, post-quantum crypto), and physical facility defense-in-depth.
• Communication and Network Security (13%): Secure network architectures, software-defined networking, micro-segmentation, transport protocols, IPsec architecture (AH, ESP, IKEv2), and wireless defenses (802.1X, EAP-TLS).
• Identity and Access Management (13%): Multi-factor authentication mechanisms, identity federation (SAML 2.0, OpenID Connect, OAuth 2.0), Kerberos ticket mechanics, privileged access management (PAM), and access control models (RBAC, ABAC).
• Security Assessment and Testing (12%): Vulnerability scanning, penetration testing methodologies, code reviews (SAST, DAST, IAST), disaster recovery testing (tabletop, parallel, full-interruption), and audit logging.
• Security Operations (13%): Incident management lifecycles, digital forensics procedures (chain of custody, order of volatility), SIEM/SOAR automation, patching frameworks, and physical access controls.
• Software Development Security (11%): Secure software development lifecycles (SSDLC), OWASP Top 10 web vulnerabilities, database security, application container security, and supply chain code verification.

Strategic Leadership & Technical Scenarios

CISSP questions test your ability to balance technical controls with business risk. You will evaluate executive trade-offs between system availability and cryptographic compliance, design enterprise identity architectures, and lead root-cause post-incident reviews.