Free ISC2 CISSP Actual Exam Questions

I think D can be ruled out because PPs are more like templates, and multiple Security Targets can claim compliance with one PP. That means it’s not a strict one-to-one relationship as D suggests.

Guessing A here too, since PPs are meant to be implementation-independent and cover consumer-driven security needs broadly, not tied to specific products or evaluations like in D.

Makes sense to rule out B and C since they don’t really relate to how plaintext changes impact ciphertext. A fits the idea of spreading out changes well. So I’d say A.

A, because diffusion is about spreading out the influence of each plaintext bit over many ciphertext bits. Permutation just shuffles bits around but doesn't ensure a small change in plaintext affects much of the ciphertext. Obfuscation and encapsulation don't directly relate to this principle. So diffusion fits perfectly here as it’s the classic property that makes sure a small plaintext change causes widespread ciphertext differences.

I think A has to be first because physical destruction completely eliminates any chance of recovery. D is next since overwriting is reliable for reuse but can still leave traces under some rare recovery methods. Between B and C, formatting (B) usually just resets file tables, so some data remains accessible, which is worse than just deleting files (C) because deletion at least removes pointers to the data, making it less visible. So I’d go A, D, C, B. Deleting files might be better than formatting for a quick cleanup, even though neither is truly secure.

I’d put A first since it completely destroys the media, then D because overwriting is solid but not perfect. B and C are way weaker since formatting or deleting doesn’t remove all data traces.

I’d put asset inventory (B) first because you can’t manage vulnerabilities without knowing what assets you have. Then scanning (C) to find weaknesses, followed by verifying and prioritizing (D) to focus efforts where they matter most. Defining roles (A) feels like it should happen alongside or just after these steps to make sure the team can act on the findings properly. Starting with roles might delay finding what actually needs protection, so sorting out the assets first seems more logical to me.

I agree with starting by defining roles (A) so responsibilities are clear, then doing asset inventory (B) to know what to protect. Scanning (C) comes next to find issues, followed by verifying and prioritizing (D) to focus efforts properly.

I think the key is the CISO confirming the risk assessment findings first, then moving to the BIA to figure out how critical the PHI data is for recovery priorities. Since the college is already HIPAA compliant, the next logical step is to use that BIA output to develop or update the BC/DR plan accordingly. So it's less about enforcing new standards and more about integrating existing compliance info into the recovery planning phases. Makes sense to treat it as a generic BC/DR sequence—risk assessment, then BIA, then strategy and implementation phases—without needing a special framework.

Since the college is compliant with HIPAA, the CISO should focus on ensuring ongoing monitoring and incident response plans are in place rather than starting new compliance checks. So, after risk assessment, BIA makes sense to set recovery priorities.

Option D seems best since it’s clearly in the DMZ, keeping contractors away from internal LAN traffic.

I’m with the group on option B but for a slightly different reason: it looks like it’s positioned in a subnet that can be monitored and controlled separately, which keeps contractor devices off the main LAN altogether. Option C might add a firewall layer, but if that segment is closer to sensitive resources, the risk could still be higher. B feels like a cleaner separation point to me—less chance of contractors accidentally crossing into parts of the enterprise network they shouldn’t access. The key is definitely isolation, and B provides that best by keeping contractor traffic segmented but s

I get why B is popular, but I’d go with D here. Knowing which exploits can attack weaknesses seems key for planning the actual attack strategy. If you don’t know what’s effective against the system, just knowing access points won’t help much. You need to match your tools to the target’s vulnerabilities first. So, D makes more sense to me in terms of prioritizing what info guides your test plan the most.

Makes sense to focus on B here. Knowing the main network access points is critical because it tells you where you can actually get in. Without that info, even having exploits or backdoor plans isn’t useful since you don’t know where to apply them. A and D come after you’ve figured out your entry points, and C is more about physical or social engineering, which isn’t the main focus in standard pen testing planning. So B seems like the logical first step to me.

Maybe C since integrity checks like TCP operate at transport layer, not network or session.

Option C makes sense since integrity checking can happen at transport or session layers, like TCP checksums. CRC (D) is definitely lower down, mostly data link, so it’s less likely here.

C/D? Security policies (C) show what should be in place, while configuration settings (D) prove if it's actually done right. Checking both gives a fuller picture than just one or the other.

It’s D for me. Configuration settings directly show how security policies are implemented in practice, so checking them helps uncover any gaps or misconfigurations that policies alone won’t reveal. You can have solid policies on paper, but if the configs aren’t right, the system’s at risk. Plus, configurations are tangible and measurable, unlike some policies that can be vague.

Maybe A makes more sense since policies lay out clear expectations for everyone, which is key for culture. Without that foundation, senior management’s goals might not trickle down effectively.

Guessing A, since no policies means no clear rules for culture to build on.

The 2019 SAMM fits best here since the question matches its governance focus.

I matched the objectives by focusing on what each question targets directly, ignoring newer terminology since the core goals haven’t changed much from 2019. This helped me avoid confusion over version differences.

Maybe B. The user has to prove who they are initially, and that usually means giving both a username and password. It’s not just a password or username alone since the service needs a way to identify the user before issuing tokens. A is definitely out since the token comes after login, not before. D alone can’t work without knowing which account the password belongs to, so B makes more sense overall.

Option B, users must provide credentials initially for OAuth to work.

I think it’s C since the biggest win from config management is cutting down errors during upgrades, which keeps systems running smoothly without unexpected issues. C

C, because minimizing errors ensures smoother system upgrades and stability.

I’d say D (scoping) first, then A (identify assets). Helps narrow focus early on.

Starting with scoping sets the stage, so I’d pick that as step one.

Maybe C, since copyright doesn't cover ideas themselves, only the specific expression.

C makes the most sense since copyright covers the specific way something is written or shown, not the underlying idea or invention. Options A and B are definitely out, as those relate to patents or natural sciences.