CISSP — Practice Questions, Part 2 flashcards

6 of 70 questions free to study here · 4 topics · the whole deck is built into Willys

Multiple-choice practice questions, one best answer each, on identity and access, security testing and SOC reports, investigations, incident response, recovery and secure software.

Get the app All ISC2 CISSP decks

Practice deck · part of ISC2 CISSP · written against: CISSP exam outline (domains effective April 2024). Updated 2026-10-10.

Study the free sample

6 questions from the deck as they are. Flip, rate yourself, filter by topic; your progress stays in this browser.

The 6 sample questions as a list

A data centre manager is choosing settings for the fingerprint reader on a vault that holds highly sensitive backup media. Which tuning goal is MOST appropriate?

A) Keep false rejections minimal so authorised staff are never delayed
B) Lower the sensitivity so that Type I errors become rare
C) Accept more false rejections to keep false acceptances low
D) Balance both error rates equally, since they cost the same

C) Accept more false rejections to keep false acceptances low

A false acceptance (Type II) lets an impostor in and is the more dangerous error, so a high-security area trades more false rejections for fewer false acceptances. Balancing the two rates ignores that the errors do not carry equal cost here.
Identity and Access Management › Authentication
A security architect is comparing biometric readers from three vendors. Which single figure BEST indicates which product is the most accurate overall?

A) The lowest false rejection rate at default settings
B) The lowest false acceptance rate at default settings
C) The lowest crossover error rate
D) The highest number of users enrolled per hour

C) The lowest crossover error rate

The crossover error rate is where FAR and FRR are equal, and a lower CER means a more accurate system, so it allows a fair comparison. A single error rate at default settings can be shifted simply by changing the sensitivity.
Identity and Access Management › Authentication
The network team wants to start a penetration test of production systems next week. What must be in place BEFORE testing begins?

A) A notice to all staff that testing will take place soon
B) A verbal go-ahead from the network team's own manager
C) Written senior management approval with agreed scope and rules
D) A complete list of known vulnerabilities from the most recent scan

C) Written senior management approval with agreed scope and rules

Testing needs written authorisation from senior management, with an agreed scope and rules of engagement; without it the test may be illegal. A verbal go-ahead from a team manager gives neither proper authority nor a record.
Security Assessment and Testing › Assessment Strategy
Midway through an authorised penetration test, the testers find signs that an outside attacker is already exploiting a flaw in production. What should they do FIRST?

A) Stop and notify the contact named in the rules of engagement
B) Exploit the flaw further to measure its full business impact
C) Patch the affected system themselves to close the gap
D) Record the finding and include it in the final report

A) Stop and notify the contact named in the rules of engagement

An active compromise cannot wait for the final report, and the rules of engagement should name who is told and when testing stops. Patching on their own would exceed the testers' authority and could destroy evidence.
Security Assessment and Testing › Assessment Strategy
Logs suggest an employee is selling customer records. Before the security manager takes the investigation any further, whom should the manager involve?

A) The press office, to prepare a public statement
B) Co-workers, to gather witness statements
C) The employee, to hear an explanation first
D) Legal counsel, with senior management and HR

D) Legal counsel, with senior management and HR

Legal counsel, with senior management and HR, decides how evidence must be handled and whether to involve law enforcement. Confronting the employee or questioning colleagues first could tip off the suspect and taint the case.
Security Operations › Investigations and Evidence
A project sponsor plans to add a security review just before go-live. When should security FIRST be involved in the project?

A) After go-live, through penetration tests
B) During system testing before release
C) During coding, once the design is set
D) During initiation and requirements

D) During initiation and requirements

Security requirements should be defined alongside functional ones at initiation, because fixing a flaw grows more expensive with each later phase. A review just before go-live finds problems when they are costliest to fix.
Software Development Security › SDLC and DevSecOps

Unlock the whole deck

You are studying a free 6-question sample. All 70 questions of CISSP — Practice Questions, Part 2, the other 5 ISC2 CISSP decks, and spaced-repetition scheduling are built into Willys. 14-day free trial, then $14.99 a year.

Get the app

In Willys, tap Exam Library at the top of your Decks (or Browse Exam Library… under the + button), find the exam on its shelf or by search, tick it and tap Add.

More ISC2 CISSP decks

Security and Risk Management, Asset Security Architecture, Engineering and Network Security Identity and Access, Security Assessment Security Operations and Software Development Security Practice Questions, Part 1

← All ISC2 CISSP decks, with the study guide and topic outline.

About these cards

Review status: Second-reader reviewed, with corrections applied.

Checked against:

ISC2 CISSP exam outline (domains effective April 2024) — topic outline only; no text copied
Checked against NIST SP 800-63B-4 (2025), SP 800-61 Rev. 3 (2025) and the withdrawn Rev. 2, SP 800-53 Rev. 5, SP 800-115, SP 800-86, SP 800-34 Rev. 1, SP 800-40 Rev. 4, SP 800-128, SP 800-162, SP 800-207, SP 800-57 Part 1 Rev. 5 and SP 800-160 Vol. 1 Rev. 1, and the SEI Capability Maturity Model for Software v1.1 — U.S. government publications; reference only, no text copied
Checked against IETF RFC 4120 (Kerberos V5) and RFC 6749 (OAuth 2.0); OpenID Connect Core 1.0; OWASP Top 10 (2021 and 2025) and OWASP SAMM; BSIMM; US Federal Rules of Evidence 803(6) and 901; AICPA & CIMA descriptions of SOC 1, SOC 2 and SOC 3 reports — reference only; no text copied

These are independent study notes written for Willys. They are not official exam material, may contain mistakes, and are no substitute for your course, your teacher or the exam owner's own publications. Found an error? Tell us — corrections ship as a new version of the deck.

CISSP® is a registered mark of ISC2, Inc. This product is not affiliated with or endorsed by ISC2.

Use of these pages is covered by our Terms of Use.