Study guides
Free CISSP practice questions
Below are 24 of our own CISSP® practice questions across all 8 domains and all four formats: single answer, multiple select, drag-and-drop and hotspot. Answer each one first; the explanation for every option appears when you reveal it.
Last reviewed 28 October 2026 · Sources · Independent; not affiliated with ISC2
Question 1Security and Risk ManagementMultiple choicehard
A defense contractor's compliance manager learns that the company has repeatedly failed to provide the documentation an agency requires to review the controls on a government system it runs. What consequence is MOST likely?
Show the answer and explanation
Correct answer
C. Loss of the authorization to operate (ATO) for that system
- A. A public summary does not replace required documentation.
- B. Risk is not transferred because documents are missing.
- C. Correct: inadequate documentation for third-party governance can void an ATO.
- D. Documentation is a condition of government authorization.
Third-party governance relies on documentation review to check that a supplier meets its obligations. In government and military contracting, failing to provide enough documentation can cost an organization its authorization to operate. That makes documentation a core part of supplier security, not an administrative extra.
The manager's view: In regulated relationships, missing paperwork is a security failure with business consequences.
Question 2Security and Risk ManagementHotspoteasy
As the risk manager, select the RMF step in which a senior official reviews the assessment results, decides whether the system's remaining risk is acceptable and grants permission to operate.
Show the answer and explanation
Correct answer
Step 6, Authorize
The Authorize step follows Assess: an authorizing official weighs the residual risk to operations, assets and individuals and either accepts it or denies operation. The assessor reports on how well controls work but does not accept risk. Monitor follows authorization and keeps that decision current.
The manager's view: Accepting residual risk is a senior management decision that cannot be delegated to the security team.
Question 3Security and Risk ManagementMultiple selectmedium
A junior security analyst is learning about baselines. Which TWO statements about baselines are accurate?
Select 2.
Show the answer and explanation
Correct answer
A. They define the minimum security level for every system of a given type
B. They often reference external benchmarks such as the CIS Benchmarks or DoD STIGs
- A. Correct: a baseline is the security floor.
- B. Correct: baselines commonly build on these sources.
- C. That describes guidelines.
- D. Baselines derive from the policy and standards.
- E. That describes procedures.
A baseline sets the minimum security every system of a type must meet and is usually system-specific. It often refers to industry or government sources such as the CIS Benchmarks or STIGs. Stricter controls can be added on top.
The manager's view: Baselines translate standards into a concrete, enforceable minimum per system type.
Question 4Asset SecurityMultiple choiceeasy
Which term BEST describes keeping important information usable for the period it is required and then destroying it?
Show the answer and explanation
Correct answer
A. Record retention
- A. Correct: retention covers both keeping data while needed and destroying it afterwards.
- B. Remanence is data left behind after removal, the opposite of a managed process.
- C. Backups create copies but do not define how long data is kept.
- D. Classification sets value and protection, not retention periods.
Record retention keeps important information available and usable for exactly as long as it is required. Once that period ends, the information is destroyed. Retention periods are usually stated in the security policy or a data policy.
The manager's view: Retention has two halves, keep and destroy, and both must be managed deliberately.
Question 5Asset SecurityMultiple selecteasy
Retention requirements apply to records, media, systems and personnel. Which TWO kinds of retention are generally considered the MOST important?
Select 2.
Show the answer and explanation
Correct answer
A. Media retention
C. Record retention
- A. Correct: media holding sensitive data must be tracked and protected until its contents are destroyed.
- B. Systems that processed sensitive data matter, but they are not the main focus.
- C. Correct: keeping the right data for the right period is central.
- D. Licences are an asset management concern rather than a core retention category.
- E. People who had access may carry lasting obligations, but this is not the main focus.
Retention requirements apply to records, media holding sensitive data, systems that process it and personnel who had access to it. Of these, record retention and media retention matter most. A business continuity vital records programme helps identify which records must be kept.
The manager's view: Retention starts with the data and the media that carries it; systems and people follow.
Question 6Asset SecurityDrag and dropeasy
As the change manager, put these change management activities in the correct order.
Press Space to pick up a step, the arrow keys to move it between positions, Enter to drop it and Escape to cancel. On a touch screen, tap a step, then tap where it goes.
Steps
Your order
Nothing placed yet.
Show the answer and explanation
Correct answer
1. Submit a formal change request
2. Review the request for impact on systems and security
3. Approve or reject the change
4. Implement the change in its scheduled window
5. Document the change and update the configuration records
Every change begins as a formal request, which is reviewed for its effect on operations and security before anyone decides to approve or reject it. Approved changes are then scheduled and implemented in a planned window. Documenting the result keeps the configuration records accurate for the next change and for audits.
The manager's view: No change reaches production without a request, an impact review and an approval on record.
Question 7Security Architecture and EngineeringMultiple choicemedium
A security architect wants each server's boot components hashed and recorded in its TPM so a remote service can later check whether anything changed, without blocking the boot itself. Which feature provides this?
Show the answer and explanation
Correct answer
D. Measured boot
- A. Secure boot blocks unsigned components rather than simply recording them.
- B. Phlashing is installing malicious firmware, an attack.
- C. Hardware segmentation separates memory physically, not boot measurements.
- D. Correct: measured boot records hashes of each boot component in the TPM for later verification.
Measured boot hashes every component in the boot chain and stores the measurements in the TPM. It does not stop anything from loading, but the records can be checked to detect tampering. Secure boot is the preventive counterpart.
The manager's view: Records you can verify later support investigation and attestation even when prevention fails.
Question 8Security Architecture and EngineeringDrag and drophard
As the procurement security manager comparing evaluated products, put these Common Criteria evaluation assurance levels in order from the least to the most rigorous.
Press Space to pick up a step, the arrow keys to move it between positions, Enter to drop it and Escape to cancel. On a touch screen, tap a step, then tap where it goes.
Steps
Your order
Nothing placed yet.
Show the answer and explanation
Correct answer
1. Functionally tested
2. Structurally tested
3. Methodically tested and checked
4. Methodically designed, tested and reviewed
5. Semiformally designed and tested
6. Semiformally verified design and tested
7. Formally verified design and tested
The seven levels climb from functional and structural testing, through methodical testing and then methodical design and review, to semiformal and finally formal design verification. The fourth level is generally the highest reached with ordinary commercial engineering; the levels above it demand specialist techniques and cost much more. An assurance level grades the rigour of the evaluation, not the absence of vulnerabilities.
The manager's view: A higher level buys confidence in how thoroughly the vendor's claims were evaluated, not a guarantee of security, so match the level to the value of what is protected.
Question 9Security Architecture and EngineeringHotspotmedium
As the security manager for a new logistics system, select the phase in which the installed controls are tested against the security requirements and a senior official formally approves the system before it goes live.
Show the answer and explanation
Correct answer
Step 3, Implementation and assessment
In implementation and assessment the system is installed in its operational environment, its controls are assessed against the requirements and a senior official decides whether to accept the residual risk. Initiation and development define and build the security, while operation and maintenance keeps it current after go-live. Testing done only during development does not prove the controls work in their real environment.
The manager's view: Insist on an independent assessment and a formal risk decision before go-live, not after the first incident.
Question 10Communication and Network SecurityMultiple choicemedium
A network engineer must run copper cabling across a factory floor full of motors and welding equipment that cause heavy electromagnetic interference. Which copper option BEST fits?
Show the answer and explanation
Correct answer
C. Shielded twisted pair
- A. This is old, slow and unshielded.
- B. Coax must be terminated and grounded to work properly.
- C. Correct: the foil shielding protects against EMI.
- D. UTP has no shielding against heavy interference.
Shielded twisted pair adds foil around the pairs to resist electromagnetic interference. Using UTP in high-interference areas is a common cabling mistake. Fibre is the best option where interference is extreme.
The manager's view: Fit the medium to the environment, or expect availability problems.
Question 11Communication and Network SecurityHotspotmedium
As the network security engineer, you deploy a SOCKS proxy that approves connections according to how a session is set up, without examining the data that flows through it. Select the OSI layer at which this circuit-level firewall operates.
Show the answer and explanation
Correct answer
Layer 5, Session
Circuit-level firewalls, of which SOCKS is the usual example, decide on session establishment and are placed at the Session layer. They do not look at content, unlike application-level firewalls at layer 7. Static packet filters work only on header addresses and ports at layers 3 and 4.
The manager's view: Know what each firewall type inspects, so you never expect content filtering from a device that never sees content.
Question 12Communication and Network SecurityMultiple selectmedium
A firewall engineer is writing edge filtering rules. Which THREE kinds of traffic should ingress and egress filtering drop?
Select 3.
Show the answer and explanation
Correct answer
A. Inbound packets claiming an internal source address
B. Outbound packets claiming an external source address
E. Traffic to or from block-listed addresses
- A. Correct: they must be spoofed.
- B. Correct: they suggest a compromised host spoofing others.
- C. Approved resolver traffic is needed for name resolution.
- D. This is the legitimate traffic the service exists for.
- E. Correct: known-bad addresses should be blocked both ways.
Ingress filters drop inbound packets with internal source addresses, and egress filters drop outbound packets with external ones. Rule bases should also block traffic to and from block-listed addresses and from unassigned internal addresses.
The manager's view: Edge filtering protects both your network and others from your network.
Question 13Identity and Access Management (IAM)Multiple choiceeasy
A turnstile in a building lobby that admits one badge holder at a time is BEST classified as which category and type of control?
Show the answer and explanation
Correct answer
D. Physical and preventive
- A. It is not a software control, and it stops rather than detects.
- B. It is not a policy or procedure, and it does more than discourage.
- C. Corrective controls fix problems after they occur.
- D. Correct: it is a tangible barrier that stops unauthorised entry.
Every control has a category (administrative, technical or physical) and a type (such as preventive, detective or corrective). A turnstile is a physical barrier that prevents unauthorised entry. Cameras in the same lobby would be physical and detective.
The manager's view: Classify each control by both category and type to see gaps in coverage.
Question 14Identity and Access Management (IAM)Multiple selectmedium
Which TWO kinds of account should privilege monitoring give the closest attention?
Select 2.
Show the answer and explanation
Correct answer
B. Domain and local administrator accounts
E. Service accounts with elevated rights
- A. Guest accounts are low privilege.
- B. Correct: they hold more than ordinary user rights.
- C. Seniority does not equal technical privilege.
- D. Ordinary users are not the focus of privilege monitoring.
- E. Correct: they are powerful and a favourite escalation target.
Privilege monitoring gives extra scrutiny to every account with more than ordinary user rights. That includes administrator and root accounts and elevated service accounts. Their misuse or compromise has the greatest impact.
The manager's view: Spend monitoring effort where the potential for harm is greatest.
Question 15Identity and Access Management (IAM)Drag and drophard
As the IAM architect explaining SAML single sign-on to a project team, put the steps of a browser sign-in in order.
Press Space to pick up a step, the arrow keys to move it between positions, Enter to drop it and Escape to cancel. On a touch screen, tap a step, then tap where it goes.
Steps
Your order
Nothing placed yet.
Show the answer and explanation
Correct answer
1. The user visits the service provider's site
2. The service provider redirects the user to the identity provider
3. The user authenticates at the identity provider
4. The identity provider returns a signed assertion to the service provider
5. The service provider grants access according to the assertion
The flow starts when the principal requests a service, which sends them to their identity provider. After the user authenticates there, the identity provider returns an assertion, usually relayed by the browser, and the service provider decides access from the statements it contains. The password never reaches the service provider.
The manager's view: Credentials go only to the identity provider; the service provider never sees them.
Question 16Security Assessment and TestingMultiple choiceeasy
A large online retailer processes millions of card transactions a year, and its compliance manager must validate compliance with PCI DSS. Which approach is MOST common for an organization of this size?
Show the answer and explanation
Correct answer
C. An assessment by a qualified security assessor
- A. Self-assessment is generally for smaller merchants.
- B. Swapped assessments are not an accepted validation method.
- C. Correct: large merchants typically validate through a QSA.
- D. COBIT is not the PCI DSS validation framework.
PCI DSS validation requirements depend on transaction volume. Large merchants typically engage a qualified security assessor to perform an onsite assessment and produce a report on compliance. Smaller merchants can often self-assess.
The manager's view: Larger exposure brings stricter, more independent validation requirements.
Question 17Security Assessment and TestingDrag and dropmedium
As the vulnerability management analyst, match each scan outcome to the kind of result it is.
Press Space to pick up an item, the arrow keys to move it between targets, Enter to drop it and Escape to cancel. On a touch screen, tap an item, then tap where it goes.
Items
True positive
False positive
True negative
False negative
Show the answer and explanation
Correct answer
The scanner reports a missing patch on a web server, and the administrator confirms the patch is absent → True positive
The scanner flags SQL injection in a login form, but manual testing shows every query is parameterised and the input cannot change it → False positive
The scanner reports nothing on a file server, yet a penetration tester later logs in with the vendor's default administrator password → False negative
The scanner reports no OpenSSL flaw on a server that does not run OpenSSL at all → True negative
A true positive is a reported flaw that really exists, and a false positive is one that does not. A false negative is a real flaw the tool missed, the most dangerous result because it creates false confidence. A true negative correctly reports nothing where nothing exists.
The manager's view: False positives waste effort, but false negatives leave real holes that nobody is looking for.
Question 18Security Assessment and TestingHotspoteasy
As the security manager for a new payroll system, you learn the system has been built and installed in its target environment; assessors are now testing its security controls so it can be formally authorized before go-live. Select the lifecycle phase the project is in.
Show the answer and explanation
Correct answer
Step 3, Implementation and assessment
Installing a system in its operational environment, testing its controls and obtaining authorization to operate all happen in the implementation and assessment phase. Development or acquisition comes earlier, when the system is designed, built or bought. Operation and maintenance starts only after the system goes live.
The manager's view: Insist that controls are tested in the real environment and formally accepted before the system carries live data.
Question 19Security OperationsMultiple choiceeasy
A storage administrator wants striping with distributed parity that can survive the failure of any single disk. What is the MINIMUM number of disks required?
Show the answer and explanation
Correct answer
A. Three
- A. Correct: RAID 5 needs at least three disks and survives one disk failure.
- B. Two disks support RAID 0 or RAID 1, but not striping with parity.
- C. Four is the minimum for RAID 6 or RAID 10, not RAID 5.
- D. Five disks work for RAID 5 but exceed the minimum.
RAID 5 stripes data with parity spread across all disks, so the array can rebuild the contents of any one failed disk. It needs at least three disks and runs more slowly while degraded. RAID 6 adds a second parity and needs four.
The manager's view: Know the RAID minimums; they decide what a single disk failure costs you.
Question 20Security OperationsHotspotmedium
As the disaster recovery coordinator, after last month's walk-through you find the call tree lists two staff who have left and a supplier contract that has expired; you correct the plan under version control and destroy the old copies. Select the step of contingency planning to which this updating work belongs.
Show the answer and explanation
Correct answer
Step 7, Plan maintenance
Plan maintenance keeps the plan current as people, systems and contracts change, using version control and removing obsolete copies. The walk-through itself belonged to testing, training and exercises, but acting on what it revealed by updating the plan is maintenance. The two steps feed each other in a continuing cycle.
The manager's view: A plan that is not kept current fails at the worst moment; tie its upkeep to change management and job descriptions.
Question 21Security OperationsMultiple selecteasy
Which TWO database recovery techniques send transaction-level data to the backup site, rather than periodic bulk copies of whole backups?
Select 2.
Show the answer and explanation
Correct answer
B. Remote journaling
C. Remote mirroring
- A. Vaulting transfers complete backups in scheduled bulk batches.
- B. Correct: journaling sends transaction logs to the remote site frequently.
- C. Correct: mirroring applies every transaction to a live copy in real time.
- D. Tape rotation schemes govern media reuse, not how transactions reach a remote site.
- E. Disk-to-disk describes the backup media, not transaction-level transfer.
Electronic vaulting moves backups in bulk, remote journaling moves transaction logs frequently and remote mirroring updates a live copy in real time. Journaling and mirroring both work at the transaction level, which is why they achieve much smaller recovery points. Mirroring costs the most.
The manager's view: Pick the database technique by how much data loss the business can tolerate.
Question 22Software Development SecurityMultiple choiceeasy
A product owner wants a final acceptance test of a vendor-built customer portal performed from the perspective of an external user who has no access to the code. Which testing approach BEST fits?
Show the answer and explanation
Correct answer
A. Black-box testing
- A. Correct: black-box testing uses only inputs and outputs, as an external user would.
- B. White-box testing requires source access, which the scenario excludes.
- C. Gray-box testers use the code to design tests.
- D. Static testing analyses code rather than the running portal.
Black-box testing examines the system only through its inputs and outputs, with no knowledge of the code. It is the classic approach for final acceptance testing before delivery. White-box and static testing require code access.
The manager's view: Acceptance should reflect what real users will experience.
Question 23Software Development SecurityMultiple selectmedium
A CTO is evaluating whether to adopt DevOps with a CI/CD pipeline. Which TWO characteristics should the CTO expect from this approach?
Select 2.
Show the answer and explanation
Correct answer
A. Small changes deployed frequently, sometimes many times a day
B. Heavy automation from the code repository through to production
- A. Correct: CI/CD enables very frequent, small deployments.
- B. Correct: automated build, test and promotion are central to CI/CD.
- C. That is the siloed model DevOps replaces.
- D. Infrequent big releases describe the traditional model.
- E. Manual sign-off on every build defeats continuous delivery.
DevOps with CI/CD automates the path from repository to production so organizations can deploy small changes very often. It removes the hand-offs between siloed teams. Manual gates on every build and rare major releases belong to the older model.
The manager's view: Faster delivery is the business goal; automation is how security and quality keep up.
Question 24Software Development SecurityDrag and dropeasy
As the development manager leading a process improvement effort, put the phases of the IDEAL model in order.
Press Space to pick up a step, the arrow keys to move it between positions, Enter to drop it and Escape to cancel. On a touch screen, tap a step, then tap where it goes.
Steps
Your order
Nothing placed yet.
Show the answer and explanation
Correct answer
1. Initiating: set out the business reasons and build sponsorship
2. Diagnosing: analyse where the organisation is now and where it wants to be
3. Establishing: plan the specific actions that will reach the goals
4. Acting: develop, pilot and refine the improvements
5. Learning: review the results and decide what to improve next
IDEAL runs Initiating, Diagnosing, Establishing, Acting and Learning: secure backing, assess the current state, plan, implement, then learn. The Learning phase feeds the next cycle, so improvement continues rather than ending with one project. Acting before diagnosing risks fixing the wrong problems.
The manager's view: Improvement starts with sponsorship and a diagnosis, not with tools.
How to use this sample set
The set above is a small slice of our question bank, chosen to show the range of topics and formats. To get the most from it:
- Answer before you reveal. Commit to an option, and note how sure you were: sure, likely, or a guess.
- Read every explanation, including the ones for options you rejected. Each explains why it is right or wrong.
- Find the operative word. BEST, FIRST, MOST, PRIMARY, LEAST or NOT decides what kind of answer is wanted. Our think like a manager guide explains each.
- Note the domain of every miss. Two misses in the same domain from a set this small is a hint worth following up.
- Do not treat the score as a prediction. Twenty-four questions are too few to say whether you are ready. They show style and gaps, not a result.
The four formats
| Format | What you do | Why it is here |
|---|---|---|
| Single answer | Choose one of four options | Most exam items take this form |
| Multiple select | Choose every option that applies | Tests whether you know the whole set, not one fact |
| Drag-and-drop | Put steps in order or match items to targets | Tests processes and relationships |
| Hotspot | Click the right area of a diagram | Tests where things sit in a model or architecture |
ISC2's outline describes the format as Multiple choice and advanced item types. The question types page covers each format in more detail.
What to do with your result
| What you saw | What it suggests | What to do next |
|---|---|---|
| Misses spread across domains | Normal early in preparation | Follow a plan by domain weight; see the study plan guide |
| Misses clustered in one or two domains | A specific gap | Read those subdomains first, then drill them |
| Right answers you marked as guesses | Knowledge that is not yet secure | Treat them as misses and review the explanations |
| Wrong answers you were sure of | A misconception or a misread | Re-read the question for the operative word and your role |
| Technical options picked over management ones | The technician's instinct | Practise with think like a manager |
| Drag-and-drop or hotspot misses | Unfamiliar formats or processes | Learn the sequence or model as a whole, then retry |
How to review a wrong answer
Most of the learning in practice happens in the two minutes after a miss. Work through these five questions each time:
- What did the question actually ask? Read it again and underline the operative word.
- Who was I in the scenario? Was the option I chose within that role's authority?
- Why did my option look right? Name the attraction: it was technical, fast, thorough, or familiar.
- Why is it wrong here? Use the explanation; say it in your own words.
- What would make my option correct? Changing one detail of the scenario until your answer becomes right is the fastest way to learn the distinction.
Then write one line in a mistakes log: the topic and the reason. After a few weeks, the log shows your patterns better than any score.
What the questions test, domain by domain
Each domain asks a different kind of question. Knowing the flavour helps you read the scenario quickly.
| Domain | Share of exam | What questions tend to ask |
|---|---|---|
| Security and Risk Management | 16% | Governance roles, risk responses, policy hierarchy, law and ethics, continuity priorities |
| Asset Security | 10% | Who owns and classifies data, how it is handled and retained, how it is destroyed |
| Security Architecture and Engineering | 13% | Secure design principles, security models, choosing cryptography, physical security |
| Communication and Network Security | 13% | Where a control sits in a network, secure protocols, segmentation |
| Identity and Access Management (IAM) | 13% | Authentication factors, access-control models, provisioning and reviews |
| Security Assessment and Testing | 12% | Which assessment fits a goal, audits, test coverage, reporting to management |
| Security Operations | 13% | Incident response order, investigations and evidence, recovery and change management |
| Software Development Security | 10% | Security in the development life cycle, code review and testing, third-party software |
Across all of them, the scenarios usually ask you to choose, prioritise or sequence, rather than define. The domains page has an overview of each.
How many questions, and how often
There is no magic total. What matters is a steady rhythm and honest review:
- While learning a domain: 10 to 15 questions on the day's topic, reviewed fully. Expect this to take 30 to 45 minutes once you include the explanations.
- Once a week: a mixed set of 30 to 50 questions across every domain studied so far, so earlier material stays sharp.
- Every two to three weeks, later in the plan: a full rehearsal under adaptive rules on unseen questions.
If a session leaves no time to read the explanations, it was too long. Cut the number of questions, not the review.
How practice questions should be used
Explanations matter more than the score
A practice question earns its value after you answer it. Reading why each wrong option is wrong teaches you the distinctions the exam tests: due care versus due diligence, a policy versus a standard, a risk owner versus a custodian. Candidates who only check whether they were right and move on often plateau at the same score for weeks.
Practise by topic, then mixed
While you are learning a domain, drill questions on that domain the same day. As you finish domains, switch to mixed sets so you practise switching context the way the exam demands.
Bring mistakes back
A question you got wrong today should come back in a few days. If you get it right twice in a row without guessing, it has done its job. If you were sure and wrong, treat the topic as a priority.
Rehearse separately
Practice questions teach. Full rehearsals measure. Use a separate pool of questions you have never seen for full rehearsals under the exam's adaptive rules, with no going back and a running clock, so your result reflects understanding rather than memory of the questions. The CAT simulator demo shows how adaptive selection behaves.
Braindumps: do not use them
Some sites sell or share collections that claim to be exam content. Do not use them: they breach the ISC2 non-disclosure agreement every candidate accepts, and ISC2 can withdraw a credential obtained in breach of it. They also teach badly, because memorised answers do not transfer to new scenarios. Use questions written by the provider, and be wary of any source that promises to show you what is on the exam.
How our question bank works
Every question in CISSP Buddy is our own, written for the platform and checked for format, keyword and coverage. The bank has 1,700+ questions across all 62 subdomains, weighted by each domain's share of the exam, and includes drag-and-drop and hotspot items alongside single-answer and multiple-select questions.
What every question carries
- A reason for every option. Why each one is right or wrong, not one paragraph for the key.
- The operative word highlighted, so you learn to spot it.
- A manager's lens note: one line on how a security leader would see the question.
- A link to the deep dive for its subdomain, so a miss leads straight to the reading.
Two pools
The bank is split into a study pool, used for practice, drills and the diagnostic, and an exam pool reserved for full rehearsals in the simulator. That way your rehearsal results are on questions you have not practised.
After each session
A summary explains every wrong answer: what you chose, why it is wrong, the right answer and why, with a link to study the topic. You can add the topic to your reading list, which brings its flashcards forward and puts it on your daily plan. Questions you miss come back on a spaced schedule until you answer them correctly twice without guessing.
What it is not
These are practice questions. They are not exam items, and they do not reproduce or hint at anything from the live exam. Our simulator follows ISC2's published rules for length, timing and adaptivity, but no practice tool can promise a result.
Next steps
- Feel the adaptive format in the CAT simulator demo.
- Train the reasoning behind the best answer at think like a manager.
- Plan where practice fits with the study plan guide.
- For the full bank, rehearsals and a readiness estimate, request an invite.
Questions people ask
Are these questions from the CISSP exam?
No. They are our own practice questions, written for CISSP Buddy. Exam items are confidential under the ISC2 non-disclosure agreement and never appear on this site.
How many practice questions should I do before the CISSP?
There is no set number. Quality matters more than volume: answer, read every explanation, and bring mistakes back until they stick. Many candidates work through well over a thousand questions over their preparation.
Is there a free CISSP practice test?
This page has 24 free questions with full explanations, and the CAT simulator demo is a free adaptive mini-test. Neither requires an account.
Does the CISSP have drag-and-drop and hotspot questions?
Yes. ISC2's outline describes the format as Multiple choice and advanced item types, which includes formats such as drag-and-drop and hotspot. Our sample set includes both.
Sources
- ISC2: CISSP certification exam outline
- ISC2: CISSP exam outline effective 15 April 2027 (PDF)
- ISC2: Computerized adaptive testing
Exam facts are taken from ISC2's published pages and checked on the date above. Always confirm current details with ISC2 before you book.