Examers.io
ExamsOrganizationsHow it worksPricingHelp & FAQ
Sign inStart free
ISC2

Certified Information Systems Security Professional

CISSP

The Certified Information Systems Security Professional (CISSP) certification validates your ability to design, implement, and manage a best-in-class cybersecurity program. It is for experienced security practitioners, managers, and executives who lead organizational security strategy and operations. Earning CISSP proves your expertise across eight security domains and grants you ISC2 membership with access to exclusive resources and a global community of cybersecurity leaders.

Practice Free Questions

1773 practice questions · Updated 2026-07-30

8Domains
62Objectives
452Concepts
1773Questions

CISSP Curriculum

Every domain, objective, and concept the CISSP exam measures.

1.1 - Understand, adhere to, and promote professional ethics

4 concepts · 26 questions
  1. ISC2 Code of Professional Ethics
  2. Organizational code of ethics
  3. Adherence to professional ethics
  4. Promotion of professional ethics

1.2 - Understand and apply security concepts

6 concepts · 25 questions
  1. Confidentiality
  2. Integrity
  3. Availability
  4. Authenticity
  5. Nonrepudiation
  6. CIA Triad and Additional Pillars

1.3 - Evaluate and apply security governance principles

5 concepts · 24 questions
  1. Business Alignment
  2. Organizational Processes
  3. Roles and Responsibilities
  4. Security Control Frameworks
  5. Due Care and Due Diligence

1.5 - Understand requirements for investigation types (i.e., administrative, criminal, civil, regulatory, industry standards)

10 concepts · 38 questions
  1. Investigation types overview
  2. Administrative investigations
  3. Criminal investigations
  4. Civil investigations
  5. Regulatory investigations
  6. Industry standards investigations
  7. Differences and relationships
  8. Evidence handling and chain of custody
  9. Legal and ethical considerations
  10. Role of security professionals

1.6 - Develop, document, and implement security policy, standards, procedures, and guidelines

7 concepts · 31 questions
  1. Security Policy Development
  2. Security Standards
  3. Security Procedures
  4. Security Guidelines
  5. Documentation of Security Framework
  6. Implementation of Security Policies
  7. Policy Review and Maintenance

1.7 - Identify, analyze, assess, prioritize, and implement Business Continuity (BC) requirements

8 concepts · 31 questions
  1. Business Impact Analysis (BIA) Fundamentals
  2. BIA Process Steps
  3. Identifying Critical Business Functions
  4. Impact Assessment Metrics
  5. Prioritizing BC Requirements
  6. External Dependencies Identification
  7. Analyzing External Dependency Risks
  8. Incorporating External Dependencies into BC Plans

1.8 - Contribute to and enforce personnel security policies and procedures

7 concepts · 28 questions
  1. Candidate Screening and Hiring
  2. Employment Agreements and Policy-Driven Requirements
  3. Onboarding Processes
  4. Transfer Processes
  5. Termination Processes
  6. Vendor, Consultant, and Contractor Agreements
  7. Vendor, Consultant, and Contractor Controls

1.9 - Understand and apply risk management concepts

9 concepts · 35 questions
  1. Threat and Vulnerability Identification
  2. Risk Analysis and Assessment
  3. Risk Response and Treatment
  4. Types of Controls
  5. Control Assessments
  6. Continuous Monitoring and Measurement
  7. Risk Reporting
  8. Continuous Improvement and Risk Maturity
  9. Risk Frameworks

1.10 - Understand and apply threat modeling concepts and methodologies

4 concepts · 23 questions
  1. Threat Modeling Fundamentals
  2. Threat Modeling Methodologies
  3. Threat Modeling Process
  4. Applying Threat Modeling

1.11 - Apply Supply Chain Risk Management (SCRM) concepts

7 concepts · 29 questions
  1. Supply chain risk identification
  2. Third-party assessment and monitoring
  3. Minimum security requirements for suppliers
  4. Service level requirements in SCRM
  5. Silicon root of trust
  6. Physically unclonable functions (PUFs)
  7. Software bill of materials (SBOM)

1.12 - Establish and maintain a security awareness, education, and training program

3 concepts · 21 questions
  1. Awareness and Training Methods
  2. Emerging Technology Content Review
  3. Program Effectiveness Evaluation

2.1 - Identify and classify information and assets

9 concepts · 34 questions
  1. Data classification
  2. Classification levels
  3. Classification criteria
  4. Classification roles and responsibilities
  5. Asset classification
  6. Asset inventory
  7. Asset classification process
  8. Asset classification levels
  9. Classification and security controls

2.2 - Establish information and asset handling requirements

5 concepts · 24 questions
  1. Data Classification
  2. Data Labeling
  3. Data Retention
  4. Data Destruction
  5. Handling Requirements

2.3 - Provision information and assets securely

3 concepts · 24 questions
  1. Information and asset ownership
  2. Asset inventory
  3. Asset management

2.4 - Manage data lifecycle

7 concepts · 28 questions
  1. Data roles
  2. Data collection
  3. Data location
  4. Data maintenance
  5. Data retention
  6. Data remanence
  7. Data destruction

2.5 - Ensure appropriate asset retention (e.g., End of Life (EOL), End of Support)

10 concepts · 18 questions
  1. Asset Retention Fundamentals
  2. Retention Requirements and Drivers
  3. Retention Policies and Procedures
  4. Retention Schedules and Classification
  5. End of Life (EOL)
  6. End of Support (EOS)
  7. EOL vs. EOS Distinction
  8. Transition Planning for EOL/EOS
  9. Secure Disposal and Sanitization
  10. Retention Auditing and Compliance

2.6 - Determine data security controls and compliance requirements

4 concepts · 18 questions
  1. Data states
  2. Scoping and tailoring
  3. Standards selection
  4. Data protection methods

3.1 - Research, implement and manage engineering processes using secure design principles

11 concepts · 24 questions
  1. Threat modeling
  2. Least privilege
  3. Defense in depth
  4. Secure defaults
  5. Fail securely
  6. Segregation of Duties (SoD)
  7. Keep it simple and small
  8. Zero trust or trust but verify
  9. Privacy by design
  10. Shared responsibility
  11. Secure access service edge

3.3 - Select controls based upon systems security requirements

7 concepts · 30 questions
  1. Security control selection process
  2. Control categories and types
  3. Security requirements analysis
  4. Control selection frameworks
  5. Cost-benefit and feasibility analysis
  6. Control integration and implementation
  7. Verification and validation of controls

3.4 - Understand security capabilities of Information Systems (IS) (e.g., memory protection, Trusted Platform Module (TPM), encryption/decryption)

15 concepts · 45 questions
  1. Memory Protection
  2. Trusted Platform Module (TPM)
  3. Encryption/Decryption Fundamentals
  4. Cryptographic Key Management
  5. Hardware Security Modules (HSM)
  6. Secure Enclaves and Trusted Execution Environments
  7. Data at Rest, in Transit, and in Use Protection
  8. Cryptographic Algorithms and Modes
  9. Digital Signatures and Hashing
  10. Public Key Infrastructure (PKI)
  11. Secure Boot and Measured Boot
  12. Virtualization Security Capabilities
  13. Database Encryption
  14. Application-Level Encryption
  15. Key Escrow and Recovery

3.5 - Assess and mitigate the vulnerabilities of security architectures, designs, and solution elements

15 concepts · 29 questions
  1. Client-based system vulnerabilities
  2. Server-based system vulnerabilities
  3. Database system vulnerabilities
  4. Cryptographic system vulnerabilities
  5. Industrial Control System (ICS) vulnerabilities
  6. Cloud-based system vulnerabilities (SaaS, IaaS, PaaS)
  7. Distributed system vulnerabilities
  8. Internet of Things (IoT) vulnerabilities
  9. Microservices and API vulnerabilities
  10. Containerization vulnerabilities
  11. Serverless vulnerabilities
  12. Embedded system vulnerabilities
  13. High-Performance Computing (HPC) system vulnerabilities
  14. Edge computing system vulnerabilities
  15. Virtualized system vulnerabilities

3.6 - Select and determine cryptographic solutions

7 concepts · 28 questions
  1. Cryptographic Life Cycle
  2. Symmetric Cryptography
  3. Asymmetric Cryptography
  4. Elliptic Curve Cryptography (ECC)
  5. Quantum Cryptography
  6. Public Key Infrastructure (PKI)
  7. Quantum Key Distribution (QKD)

3.7 - Understand methods of cryptanalytic attacks

13 concepts · 42 questions
  1. Brute force attack
  2. Ciphertext-only attack
  3. Known-plaintext attack
  4. Frequency analysis
  5. Chosen-ciphertext attack
  6. Implementation attacks
  7. Side-channel attack
  8. Fault injection attack
  9. Timing attack
  10. Man-in-the-Middle (MITM) attack
  11. Pass the hash attack
  12. Kerberos exploitation
  13. Ransomware attack

3.8 - Apply security principles to site and facility design

7 concepts · 29 questions
  1. Site Selection Criteria
  2. Facility Design Principles
  3. Physical Security Controls
  4. Fire Safety and Life Safety
  5. Environmental and Utility Systems
  6. Crime Prevention Through Environmental Design (CPTED)
  7. Compliance and Standards

3.9 - Design site and facility security controls

9 concepts · 34 questions
  1. Wiring Closets and Intermediate Distribution Facilities
  2. Server Rooms and Data Centers
  3. Media Storage Facilities
  4. Evidence Storage
  5. Restricted and Work Area Security
  6. Utilities and HVAC
  7. Environmental Issues
  8. Fire Prevention, Detection, and Suppression
  9. Power Redundancy and Backup

3.10 - Manage the information system lifecycle

9 concepts · 36 questions
  1. Stakeholder Needs and Requirements
  2. Requirements Analysis
  3. Architectural Design
  4. Development and Implementation
  5. Integration
  6. Verification and Validation
  7. Transition and Deployment
  8. Operations and Maintenance
  9. Retirement and Disposal

4.1 - Apply secure design principles in network architectures

18 concepts · 52 questions
  1. OSI and TCP/IP Models
  2. IPv4 and IPv6 Addressing
  3. Secure Protocols
  4. Multilayer Protocol Implications
  5. Converged Protocols
  6. Network Transport Architectures
  7. Network Performance Metrics
  8. Traffic Flow Patterns
  9. Physical Segmentation
  10. Logical Segmentation
  11. Micro-segmentation
  12. Edge Networks
  13. Wireless Networks
  14. Cellular and Mobile Networks
  15. Content Distribution Networks (CDN)
  16. Software-Defined Networking (SDN)
  17. Virtual Private Cloud (VPC)
  18. Network Monitoring and Management

4.2 - Secure network components

4 concepts · 17 questions
  1. Infrastructure Operation
  2. Transmission Media Security
  3. Network Access Control (NAC)
  4. Endpoint Security

4.3 - Implement secure communication channels according to design

6 concepts · 32 questions
  1. Secure Voice and Video Communications
  2. Secure Collaboration Tools
  3. Secure Remote Access for Administration
  4. Secure Data Communications (Backhaul)
  5. Secure Satellite Communications
  6. Secure Third-Party Connectivity

5.1 - Control physical and logical access to assets

7 concepts · 26 questions
  1. Access Control Fundamentals
  2. Information Access Control
  3. System Access Control
  4. Device Access Control
  5. Facility Access Control
  6. Application Access Control
  7. Service Access Control

5.2 - Design identification and authentication strategy (e.g., people, devices, and services)

10 concepts · 37 questions
  1. Groups and Roles
  2. Authentication, Authorization, and Accounting (AAA)
  3. Multi-Factor Authentication (MFA)
  4. Password-less Authentication
  5. Session Management
  6. Identity Registration and Proofing
  7. Federated Identity Management (FIM)
  8. Credential Management Systems
  9. Single Sign-On (SSO)
  10. Just-In-Time (JIT) Provisioning

5.3 - Federated identity with a third-party service

4 concepts · 25 questions
  1. Federated Identity Fundamentals
  2. On-Premise Federation
  3. Cloud Federation
  4. Hybrid Federation

5.4 - Implement and manage authorization mechanisms

7 concepts · 28 questions
  1. Role-Based Access Control (RBAC)
  2. Rule-Based Access Control
  3. Mandatory Access Control (MAC)
  4. Discretionary Access Control (DAC)
  5. Attribute-Based Access Control (ABAC)
  6. Risk-Based Access Control
  7. Access Policy Enforcement

5.5 - Manage the identity and access provisioning lifecycle

5 concepts · 18 questions
  1. Account Access Review
  2. Provisioning and Deprovisioning
  3. Role Definition and Transition
  4. Privilege Escalation and Auditing
  5. Service Accounts Management

5.6 - Implement authentication systems

11 concepts · 25 questions
  1. Authentication Factors
  2. Single-Factor vs. Multi-Factor Authentication
  3. Password-Based Authentication
  4. Token-Based Authentication
  5. Biometric Authentication
  6. Certificate-Based Authentication
  7. Single Sign-On (SSO)
  8. Federated Identity Management
  9. Authentication Protocols
  10. Adaptive Authentication
  11. Authentication Authorization and Accounting (AAA)

6.1 - Design and validate assessment, test, and audit strategies

4 concepts · 24 questions
  1. Internal assessment strategies
  2. External assessment strategies
  3. Third-party assessment strategies
  4. Assessment location considerations

6.2 - Conduct security control testing

10 concepts · 34 questions
  1. Vulnerability Assessment
  2. Penetration Testing
  3. Log Reviews
  4. Synthetic Transactions and Benchmarks
  5. Code Review and Testing
  6. Misuse Case Testing
  7. Coverage Analysis
  8. Interface Testing
  9. Breach Attack Simulations
  10. Compliance Checks

6.3 - Collect security process data (e.g., technical and administrative)

8 concepts · 36 questions
  1. Account Management Data Collection
  2. Management Review and Approval Processes
  3. Key Performance Indicators (KPIs) for Security
  4. Key Risk Indicators (KRIs) for Security
  5. Backup Verification Data
  6. Security Training and Awareness Metrics
  7. Disaster Recovery (DR) Test Data
  8. Business Continuity (BC) Exercise Data

6.4 - Analyze test output and generate report

3 concepts · 19 questions
  1. Remediation
  2. Exception Handling
  3. Ethical Disclosure

6.5 - Conduct or facilitate security audits

4 concepts · 19 questions
  1. Internal audits
  2. External audits
  3. Third-party audits
  4. Audit location considerations

7.1 - Understand and comply with investigations

5 concepts · 29 questions
  1. Evidence Collection and Handling
  2. Reporting and Documentation
  3. Investigative Techniques
  4. Digital Forensics Tools, Tactics, and Procedures
  5. Artifacts: Data, Computer, Network, Mobile Device

7.2 - Conduct logging and monitoring activities

12 concepts · 41 questions
  1. Intrusion Detection and Prevention Systems (IDPS)
  2. IDPS Response and Evasion Techniques
  3. Security Information and Event Management (SIEM)
  4. SIEM Use Cases and Implementation
  5. Continuous Monitoring and Tuning
  6. Egress Monitoring
  7. Log Management
  8. Log Analysis and Review
  9. Threat Intelligence Feeds
  10. Threat Hunting
  11. User and Entity Behavior Analytics (UEBA)
  12. UEBA Implementation and Use Cases

7.3 - Perform Configuration Management (CM) (e.g., provisioning, baselining, automation)

5 concepts · 29 questions
  1. Provisioning
  2. Baselining
  3. Automation
  4. Configuration Management Process
  5. CM Tools and Technologies

7.4 - Apply foundational security operations concepts

5 concepts · 23 questions
  1. Need-to-know/least privilege
  2. Separation of Duties (SoD)
  3. Privileged account management
  4. Job rotation
  5. Service-level agreements (SLA)

7.5 - Apply resource protection

4 concepts · 22 questions
  1. Media management lifecycle
  2. Media protection techniques
  3. Data at rest protection
  4. Data in transit protection

7.6 - Conduct incident management

7 concepts · 32 questions
  1. Incident Detection
  2. Incident Response
  3. Incident Mitigation
  4. Incident Reporting
  5. Incident Recovery
  6. Incident Remediation
  7. Lessons Learned

7.7 - Operate and maintain detection and preventative measures

8 concepts · 30 questions
  1. Firewall types and functions
  2. IDS and IPS fundamentals
  3. Whitelisting and blacklisting
  4. Third-party security services
  5. Sandboxing
  6. Honeypots and honeynets
  7. Anti-malware mechanisms
  8. Machine learning and AI in security tools

7.8 - Implement and support patch and vulnerability management

9 concepts · 30 questions
  1. Patch Management Process
  2. Vulnerability Management Lifecycle
  3. Vulnerability Scanning Tools and Techniques
  4. Patch Testing and Deployment Strategies
  5. Risk-Based Prioritization
  6. Compliance and Reporting
  7. Integration with Change Management
  8. Automation and Orchestration
  9. Metrics and Continuous Improvement

7.9 - Understand and participate in change management processes

10 concepts · 38 questions
  1. Change Management Fundamentals
  2. Change Management Process Steps
  3. Change Advisory Board (CAB)
  4. Change Types and Classification
  5. Change Documentation and Tracking
  6. Security Impact Assessment
  7. Rollback and Backout Procedures
  8. Testing and Validation
  9. Communication and Stakeholder Notification
  10. Integration with Incident Management

7.10 - Implement recovery strategies

7 concepts · 31 questions
  1. Backup storage strategies
  2. Recovery site strategies
  3. Multiple processing sites
  4. System resilience
  5. High availability (HA)
  6. Quality of Service (QoS)
  7. Fault tolerance

7.11 - Implement Disaster Recovery (DR) processes

7 concepts · 29 questions
  1. DR Response Procedures
  2. DR Personnel Roles and Responsibilities
  3. DR Communication Methods
  4. DR Assessment and Damage Evaluation
  5. Restoration and Recovery Operations
  6. DR Training and Awareness Programs
  7. Lessons Learned and Plan Improvement

7.12 - Test Disaster Recovery Plans (DRP)

6 concepts · 15 questions
  1. Read-through/tabletop test
  2. Walkthrough test
  3. Simulation test
  4. Parallel test
  5. Full interruption test
  6. Test communications

7.13 - Participate in Business Continuity (BC) planning and exercises

8 concepts · 34 questions
  1. Business Continuity Planning Fundamentals
  2. BC Plan Components
  3. Business Impact Analysis (BIA)
  4. Recovery Strategies
  5. BC Plan Documentation
  6. BC Plan Testing and Exercises
  7. Exercise Planning and Execution
  8. Post-Exercise Review and Improvement

7.14 - Implement and manage physical security

2 concepts · 21 questions
  1. Perimeter security controls
  2. Internal security controls

7.15 - Address personnel safety and security concerns

7 concepts · 29 questions
  1. Travel Security
  2. Security Training and Awareness
  3. Insider Threat Awareness
  4. Social Media Impact on Security
  5. Two-Factor Authentication (2FA) Fatigue
  6. Emergency Management
  7. Duress Response

8.1 - Understand and integrate security in the Software Development Life Cycle (SDLC)

5 concepts · 28 questions
  1. Development methodologies
  2. Maturity models
  3. Operation and maintenance
  4. Change management
  5. Integrated Product Team

8.2 - Identify and apply security controls in software development ecosystems

12 concepts · 41 questions
  1. Programming Languages
  2. Libraries
  3. Tool Sets
  4. Integrated Development Environment (IDE)
  5. Runtime Environment
  6. Continuous Integration and Continuous Delivery (CI/CD)
  7. Software Configuration Management (CM)
  8. Code Repositories
  9. Static Application Security Testing (SAST)
  10. Dynamic Application Security Testing (DAST)
  11. Software Composition Analysis (SCA)
  12. Interactive Application Security Testing (IAST)

8.3 - Assess the effectiveness of software security

8 concepts · 32 questions
  1. Audit logging fundamentals
  2. Change logging and monitoring
  3. Audit trail analysis
  4. Log protection and integrity
  5. Risk assessment in software security
  6. Risk mitigation strategies
  7. Risk analysis methods
  8. Effectiveness evaluation of security controls

8.4 - Assess security impact of acquired software

5 concepts · 23 questions
  1. Commercial-off-the-shelf (COTS) software security assessment
  2. Open source software security assessment
  3. Third-party software security assessment
  4. Managed services security assessment
  5. Cloud service models security assessment

8.5 - Define and apply secure coding guidelines and standards

4 concepts · 28 questions
  1. Source-Code Weaknesses
  2. API Security Fundamentals
  3. Secure Coding Standards
  4. Software-Defined Security
Ready to practice?Test your knowledge with exam-style questions or take an intelligent quiz tailored to your level.
Practice Free Questions

Percentages reflect share of the current practice bank, not official exam weightings — no structured per-skill weight is published for CISSP, so none is invented.