CISSP — Practice Questions, Part 1 flashcards
6 of 70 questions free to study here · 4 topics · the whole deck is built into Willys
Multiple-choice practice questions, one best answer each, on ethics, governance, risk, BCP, privacy law, data security, security models, crypto, physical and network security.
Practice deck · part of ISC2 CISSP · written against: CISSP exam outline (domains effective April 2024). Updated 2026-10-10.
Study the free sample
6 questions from the deck as they are. Flip, rate yourself, filter by topic; your progress stays in this browser.
Tap the card or press Space to flip
The 6 sample questions as a list
-
During an engagement, a consultant finds that a client's infusion-pump software has a flaw that could endanger hospital patients. The client asks the consultant to keep it quiet until next year's release. Under the ISC2 Code of Ethics, which consideration should carry the MOST weight?
A) Serving the client diligently as the principal
B) Protecting society, public trust and safety
C) Honouring the confidentiality terms in the contract
D) Advancing and protecting the profession's imageB) Protecting society, public trust and safetySecurity and Risk Management › Professional Ethics
Patient safety falls under the first canon, and ISC2's Code of Professional Conduct expects professionals to report flaws that could leave the public at risk, so it carries more weight than the client's wishes (A), the contract's confidentiality terms (C) or the profession's image (D). -
A CISSP is asked to lead a security review of an industrial control system, a technology the CISSP has never worked with. What is the MOST appropriate response under the ISC2 Code of Ethics?
A) Accept, since the CISSP covers every domain of security work
B) Accept and learn the technology during the review
C) Accept and rely on the vendor's own security guide
D) Disclose the gap and decline or bring in qualified helpD) Disclose the gap and decline or bring in qualified helpSecurity and Risk Management › Professional Ethics
The third canon requires diligent and competent service to principals. Taking work beyond your competence without disclosing it fails the client; holding the certification does not make you an expert in every technology. -
A company has never classified any of its data. As the security manager, what should you do FIRST?
A) Inventory the information assets and assign each an owner
B) Encrypt every file server and database across the company first
C) Buy and deploy a data loss prevention product
D) Label every document as confidential by defaultA) Inventory the information assets and assign each an ownerAsset Security › Classification and Ownership
You cannot classify or protect what you have not found, so start by building an inventory and assigning owners under a management-approved classification policy. Encryption and DLP are controls chosen after classification. -
A shared project folder holds public brochures plus one internal file containing customers' bank details. At what level should the folder be classified?
A) The level that matches most of its contents
B) The lowest level, so the folder is easy to share
C) Whatever level the last editor chooses for it
D) The level of the most sensitive data it holdsD) The level of the most sensitive data it holdsAsset Security › Classification and Ownership
Mixed collections are classified at the highest level of any data they contain. Classifying by the majority of contents would leave the bank details under-protected. -
A web server process runs with full administrative rights, although it only needs to read files in one directory. Which design principle is violated MOST directly?
A) Need to know
B) Defence in depth
C) Separation of duties
D) Least privilegeD) Least privilegeSecurity Architecture and Engineering › Secure Design Principles
Least privilege limits the permissions a user or process holds to the minimum its function requires. Need to know is tempting, but it governs access to specific information by people, not the rights a process runs with. -
Two offices are linked by an IPsec tunnel, and the traffic between them must be kept confidential. Which IPsec protocol provides this?
A) MPLS label switching beneath the tunnel
B) Authentication Header (AH)
C) Internet Key Exchange (IKE) on its own
D) Encapsulating Security Payload (ESP)D) Encapsulating Security Payload (ESP)Communication and Network Security › Secure Protocols
ESP provides encryption plus integrity of the payload. AH authenticates and integrity-protects packets but offers no confidentiality, and IKE only negotiates the security associations and keys.
Unlock the whole deck
You are studying a free 6-question sample. All 70 questions of CISSP — Practice Questions, Part 1, the other 5 ISC2 CISSP decks, and spaced-repetition scheduling are built into Willys. 14-day free trial, then $14.99 a year.
In Willys, tap Exam Library at the top of your Decks (or Browse Exam Library… under the + button), find the exam on its shelf or by search, tick it and tap Add.
More ISC2 CISSP decks
← All ISC2 CISSP decks, with the study guide and topic outline.
About these cards
Review status: Second-reader reviewed, with corrections applied.
Checked against:
- ISC2 CISSP exam outline (domains effective April 2024) — topic outline only; no text copied
- NIST SP 800-88 Rev. 2 (September 2025), SP 800-53B, SP 800-34 Rev. 1 and SP 800-207 — concepts checked, no text copied
- Regulation (EU) 2016/679 (GDPR) Arts. 5 and 33; RFC 2827 (BCP 38); RFC 4301 — concepts checked, no text copied
These are independent study notes written for Willys. They are not official exam material, may contain mistakes, and are no substitute for your course, your teacher or the exam owner's own publications. Found an error? Tell us — corrections ship as a new version of the deck.
CISSP® is a registered mark of ISC2, Inc. This product is not affiliated with or endorsed by ISC2.
Use of these pages is covered by our Terms of Use.