Try 8 Real Questions From CISSP Questions & Answers - 639 Original Questions with Full Rationales
These are unedited questions from the full 639-question set, pulled from across every exam domain. Click a question to reveal the answer and the full rationale for every option, exactly as it appears in the PDF.
A risk manager calculates that a threat has a 20% annual likelihood of occurring and would cause $500,000 in damage if realized. What is the Annualized Loss Expectancy (ALE)?
Show answer & full rationale
A: $500,000 is the Single Loss Expectancy (SLE) alone, not adjusted for annual likelihood.
B: $2,500,000 would result from dividing rather than multiplying by the rate, an incorrect calculation.
C: $20,000 does not correctly apply the ALE formula to the given figures.
D (Correct): ALE equals Single Loss Expectancy multiplied by Annual Rate of Occurrence: $500,000 x 0.20 = $100,000.
An organization must securely dispose of hard drives containing regulated customer data. Which method provides the HIGHEST assurance that data cannot be recovered?
Show answer & full rationale
A (Correct): Physical destruction following a documented sanitization standard (such as NIST 800-88) provides the highest assurance that data is unrecoverable.
B: Relabeling and storing does not destroy or alter the data at all; it remains fully intact and recoverable if accessed.
C: Recycle bin deletion only removes file references; the underlying data remains recoverable with common tools.
D: A quick format does not overwrite data and leaves most content recoverable through forensic techniques.
A security architect is redesigning network access so that no user or device is trusted by default, regardless of whether it is inside or outside the corporate network perimeter. Every request must be authenticated, authorized, and continuously validated. What architectural model is being implemented?
Show answer & full rationale
A (Correct): Zero Trust assumes no implicit trust based on network location and requires continuous verification of every access request, matching the scenario described.
B: A flat network with one perimeter firewall still grants broad implicit trust to anything already inside, the opposite of the model described.
C: Implicit trust for internal VLANs is exactly what Zero Trust is designed to eliminate.
D: Castle-and-moat relies on a hardened perimeter and trusts everything inside it, which contradicts continuous verification of every request.
A company's wireless network uses WPA3 rather than WEP or WPA2. What is the PRIMARY security improvement WPA3 provides?
Show answer & full rationale
A: WPA3 still requires authentication credentials; it does not eliminate the need for a password on secured networks.
B: WPA3 is a security protocol enhancement and has no direct relationship to wireless signal range.
C: WPA3 is not universally backward-compatible with all legacy devices, some of which may not support the newer protocol.
D (Correct): WPA3 provides stronger encryption and uses a more secure handshake mechanism, significantly improving protection against offline password-guessing (brute-force/dictionary) attacks compared to WPA2.
A company requires employees to use both a password and a one-time code from a mobile authenticator app to log in. What is this an example of?
Show answer & full rationale
A (Correct): Combining a password (something you know) with a one-time code from an authenticator app (something you have) is a classic example of multi-factor authentication.
B: Federated identity management allows identity information to be shared and trusted across different organizations or domains, a different concept from combining authentication factors.
C: SSO allows a single authentication event to grant access to multiple systems; it addresses convenience across systems, not the number of factors used to authenticate.
D: RBAC governs what permissions a user has after authentication, not the authentication process itself.
A company wants to test its incident response plan without impacting live production systems. Which exercise type is MOST appropriate for this initial evaluation?
Show answer & full rationale
A: Disabling security monitoring introduces unnecessary risk and does not constitute a legitimate method for testing incident response procedures.
B: A live, full-scale attack against production without planning carries significant operational risk, inappropriate for an initial, lower-risk evaluation.
C: Deploying untested changes to production is an unrelated, risky software deployment practice, not an appropriate way to test an incident response plan.
D (Correct): A tabletop exercise provides a discussion-based walkthrough of response procedures in a low-risk setting, allowing teams to evaluate the plan without impacting live production systems.
A company's incident responders isolate a compromised workstation from the network but leave it powered on to preserve volatile memory for forensic analysis. What principle does this action reflect?
Show answer & full rationale
A: Isolating the device and preserving evidence are deliberate response actions, not an indication of ignoring the incident.
B: Isolating the device specifically limits, rather than expands, its network connectivity to contain the threat.
C (Correct): Isolating the workstation contains the threat by cutting off network access, while keeping it powered on preserves volatile memory contents, balancing the need for containment with preserving valuable forensic evidence for investigation.
D: Preserving volatile memory specifically aims to retain evidence, the opposite of destroying it.
A CI/CD pipeline currently stores database passwords and API keys as plaintext environment variables inside the build configuration file, which is readable by every developer with repository access. What change BEST addresses this exposure?
Show answer & full rationale
A: Disk-level encryption does not stop an authorized repository reader from viewing the plaintext file's contents.
B: Rotation on a schedule reduces the exposure window but does not remove the plaintext secrets from the readable file.
C (Correct): A secrets vault centralizes storage, enforces access control and auditing, and keeps secrets out of version-controlled files entirely, directly resolving the exposure.
D: Tenure is not an access control mechanism and does not address secrets being stored in plaintext.
CISSP Questions & Answers - 639 Original Questions with Full Rationales — $29.99, instant PDF download with full rationale on every answer.
View the practice questions →