CISSP Practice Questions (2024 Exam Outline)
CISSP is the senior security certification hiring managers screen for, and the adaptive exam rewards management judgment far more than raw technical recall. This is a serious practice bank: 10 full-length timed forms, roughly 1,250 original questions across all eight domains at official weighting, with a clear rationale for every answer. Take a free timed practice test first, then unlock the full bank for $89 one time.
By PrepClubs Editorial Team, updated October 8, 2026
CISSP is a senior, vendor-neutral information security certification for experienced practitioners. Since April 15, 2024 the exam is delivered as Computerized Adaptive Testing (CAT) in every language. It runs 100 to 150 items in a maximum of 3 hours, mixing multiple-choice with advanced innovative items such as drag-and-drop and hotspot, across eight domains: Security and Risk Management, Asset Security, Security Architecture and Engineering, Communication and Network Security, Identity and Access Management, Security Assessment and Testing, Security Operations, and Software Development Security. The passing standard is a scaled 700 out of 1000, reported as pass or fail with no numeric score to the candidate. It is widely treated as a benchmark for security leadership and management roles.
Source: (ISC)2 CISSP Exam Outline, effective April 15, 2024. PrepClubs is not affiliated with (ISC)2.
A full CISSP bank, with a rationale for every answer
Official facts checked 8 Oct 2026
How long is the CISSP exam and how many questions does it have?
The CISSP exam gives you up to 3 hours and between 100 and 150 items, according to ISC2. It is a computerized adaptive test, so the length depends on your answers and it can end at any point after item 100. The exam covers eight domains, and security and risk management is the largest at 16%. ISC2 does not publish a calculator rule for the exam.
“Candidates will be presented with a minimum of 100 items on all examinations. The maximum item count is 125 for the CC and SSCP or 150 items for the CISSP and CCSP examinations.”
“Maximum administration time for CISSP is three hours.”
Which CISSP practice tests are on PrepClubs, and how long is each one?
PrepClubs has 11 CISSP practice tests: 1 diagnostic and 10 full-length forms, 1,275 questions in all. 10 run 125 questions in 180 minutes, 1 runs 25 questions in 25 minutes.
The question count, time limit and question mix in each row are read from the question bank that runs the live tests, last on 8 Oct 2026, so each row matches what the test shows when you open it. The real exam is adaptive and ends somewhere between 100 and 150 items. Our forms are fixed at 125 questions on the same 3-hour clock.
Showing 11 of 11 CISSP practice tests
- Security and Risk Management
- Asset Security
- Communication and Network Security
- Identity and Access Management
- Security Architecture and Engineering
- Security Assessment and Testing
- Security Operations
- Software Development Security
| Question mix | Calculator | Guide | |||||
|---|---|---|---|---|---|---|---|
| CISSP Diagnostic Diagnostic | 25 | 25 min | 60 s | Security and Risk Management 4 · Asset Security 3 · Communication and Network Security 3 5 more areasIdentity and Access Management 3 · Security Architecture and Engineering 3 · Security Assessment and Testing 3 · Security Operations 3 · Software Development Security 3 | Not allowed | CISSP domains | |
| CISSP Practice Test 1 Full-length | 125 | 180 min | 86.4 s | Security and Risk Management 20 · Communication and Network Security 16 · Identity and Access Management 16 5 more areasSecurity Architecture and Engineering 16 · Security Operations 16 · Security Assessment and Testing 15 · Asset Security 13 · Software Development Security 13 | Not allowed | CISSP domains | |
| CISSP Practice Test 2 Full-length | 125 | 180 min | 86.4 s | Security and Risk Management 20 · Communication and Network Security 16 · Identity and Access Management 16 5 more areasSecurity Architecture and Engineering 16 · Security Operations 16 · Security Assessment and Testing 15 · Asset Security 13 · Software Development Security 13 | Not allowed | CISSP domains | |
| CISSP Practice Test 3 Full-length | 125 | 180 min | 86.4 s | Security and Risk Management 20 · Communication and Network Security 16 · Identity and Access Management 16 5 more areasSecurity Architecture and Engineering 16 · Security Operations 16 · Security Assessment and Testing 15 · Asset Security 13 · Software Development Security 13 | Not allowed | CISSP domains | |
| CISSP Practice Test 4 Full-length | 125 | 180 min | 86.4 s | Security and Risk Management 20 · Communication and Network Security 16 · Identity and Access Management 16 5 more areasSecurity Architecture and Engineering 16 · Security Operations 16 · Security Assessment and Testing 15 · Asset Security 13 · Software Development Security 13 | Not allowed | CISSP domains | |
| CISSP Practice Test 5 Full-length | 125 | 180 min | 86.4 s | Security and Risk Management 20 · Communication and Network Security 16 · Identity and Access Management 16 5 more areasSecurity Architecture and Engineering 16 · Security Operations 16 · Security Assessment and Testing 15 · Asset Security 13 · Software Development Security 13 | Not allowed | CISSP domains | |
| CISSP Practice Test 6 Full-length | 125 | 180 min | 86.4 s | Security and Risk Management 20 · Communication and Network Security 16 · Identity and Access Management 16 5 more areasSecurity Architecture and Engineering 16 · Security Operations 16 · Security Assessment and Testing 15 · Asset Security 13 · Software Development Security 13 | Not allowed | CISSP domains | |
| CISSP Practice Test 7 Full-length | 125 | 180 min | 86.4 s | Security and Risk Management 20 · Communication and Network Security 16 · Identity and Access Management 16 5 more areasSecurity Architecture and Engineering 16 · Security Operations 16 · Security Assessment and Testing 15 · Asset Security 13 · Software Development Security 13 | Not allowed | CISSP domains | |
| CISSP Practice Test 8 Full-length | 125 | 180 min | 86.4 s | Security and Risk Management 20 · Communication and Network Security 16 · Identity and Access Management 16 5 more areasSecurity Architecture and Engineering 16 · Security Operations 16 · Security Assessment and Testing 15 · Asset Security 13 · Software Development Security 13 | Not allowed | CISSP domains | |
| CISSP Practice Test 9 Full-length | 125 | 180 min | 86.4 s | Security and Risk Management 20 · Communication and Network Security 16 · Identity and Access Management 16 5 more areasSecurity Architecture and Engineering 16 · Security Operations 16 · Security Assessment and Testing 15 · Asset Security 13 · Software Development Security 13 | Not allowed | CISSP domains | |
| CISSP Practice Test 10 Full-length | 125 | 180 min | 86.4 s | Security and Risk Management 20 · Communication and Network Security 16 · Identity and Access Management 16 5 more areasSecurity Architecture and Engineering 16 · Security Operations 16 · Security Assessment and Testing 15 · Asset Security 13 · Software Development Security 13 | Not allowed | CISSP domains |
Sources
- ISC2: Computerized Adaptive Testing (isc2.org), checked 8 Oct 2026
- ISC2: CISSP certification exam outline (isc2.org), checked 8 Oct 2026
- ISC2: CISSP (isc2.org), checked 8 Oct 2026
- PrepClubs question bank, the files behind the live CISSP practice tests, read 8 Oct 2026
“Not published” means the publisher does not state that fact on any page we could find. We leave it blank instead of quoting a prep site.
What you get with the full bank
A large bank of original CISSP practice questions written to the current (ISC)2 CISSP Exam Outline, effective April 15, 2024. Full coverage of all eight domains, weighted to the official blueprint: Security and Risk Management, Asset Security, Security Architecture and Engineering, Communication and Network Security, Identity and Access Management, Security Assessment and Testing, Security Operations, and Software Development Security.
A clear rationale for every question. We explain why the best answer is best and why each other option is second-best or wrong, so you build the management-level reasoning the exam actually tests rather than memorizing answers. The bank leans into the CISSP signature: all four options are defensible, and the stem keyword (BEST, FIRST, NEXT, MOST effective) decides the winner.
Two ways to practice. Exam mode is a timed, full-length 125-question form built to the real domain weighting, so you rehearse under exam conditions. Study mode lets you practice by domain, review rationales as you go, and retry the questions you missed.
The eight CISSP domains and their official weight
Every one of the 10 forms is built to the same domain weighting, so each is a true full-length rehearsal of the real exam.
Security and Risk Management (16%)
The heaviest domain. Governance, security roles, the CIA triad, risk management and treatment, policy, legal and regulatory obligations, professional ethics, third-party risk, and business continuity scope. The judgment core of the exam.
Asset Security (10%)
Data classification and handling, owner versus custodian roles, the data lifecycle, data states, retention and destruction, remanence and sanitization, privacy protection, and baseline scoping and tailoring.
Security Architecture and Engineering (13%)
Secure design principles, security models such as Bell-LaPadula and Biba, cryptography and PKI, crypto attacks, physical and site security, and cloud, virtualization, IoT, and embedded security.
Communication and Network Security (13%)
OSI and TCP/IP models, secure network architecture, segmentation, secure protocols such as TLS, IPsec, and SSH, wireless security, network attacks and defenses, firewalls, IDS and IPS, and remote access.
Identity and Access Management (13%)
Identification, authentication, authorization, and accountability, MFA and authentication factors, access control models (DAC, MAC, RBAC, ABAC), SSO and federation, the identity lifecycle, and privileged access management.
Security Assessment and Testing (12%)
Assessment and test strategies, vulnerability assessment versus penetration testing, audits, log review, code review and testing, test coverage, collecting security process data, and reporting to management.
Security Operations (13%)
Incident response lifecycle and ordering, detection and monitoring, digital forensics and evidence handling, change and configuration management, patch management, foundational operations concepts, and backup and recovery.
Software Development Security (10%)
The secure SDLC, development methodologies and maturity models, secure coding, common software vulnerabilities, software security testing, API and database security, and assessing acquired software.
Try eight real CISSP questions, one from each domain
One item from each of the eight domains in the April 2024 exam outline. These are management-level items, not trivia, which is what the CISSP actually tests. They sit in the final practice test, so you will not meet them again early. Click a question to reveal the answer and the reasoning.
- A.Supply chain risk from unvetted subcontractors behind the provider
- B.Vendor lock-in risk from the provider's proprietary services
- C.Concentration risk from critical services in one provider region
- D.Residual risk left after each vendor's due diligence review
- A.Inference, addressed by suppressing results below a minimum group size
- B.Aggregation, addressed by classifying the combined result higher
- C.Polyinstantiation, addressed by storing one record version per level
- D.Contamination, addressed by keeping sensitivity levels in separate stores
- A.Cross-site request forgery, riding a victim's authenticated session
- B.Cross-site scripting, running attacker script in another user's browser
- C.Server-side request forgery, abusing the server's inside network reach
- D.Open redirect, bouncing a user to an attacker-controlled destination
- A.DNSSEC, DANE, and MTA-STS published together
- B.SPF, DKIM, and DMARC published together
- C.S/MIME, PGP, and STARTTLS deployed together
- D.SMTP AUTH, greylisting, and blocklists together
- A.Hierarchical role-based access control with role inheritance
- B.Mandatory access control driven by classification labels
- C.Discretionary access control delegated to resource owners
- D.Attribute-based access control driven by policy evaluation
- A.A vulnerability disclosure program with scope and safe harbor
- B.A recurring third-party penetration test each release cycle
- C.A security advisory mailing list for notifying customers
- D.A threat intelligence feed covering emerging public exploits
- A.Recovery point objective, the tolerable amount of data loss
- B.Recovery time objective, the target for restoring the system
- C.Maximum tolerable downtime, the outer limit on total outage
- D.Work recovery time, the validation window after restoration
- A.Server-side request forgery on an internal endpoint
- B.Insecure deserialization of untrusted client data
- C.Command injection through an unsanitized parameter
- D.Server-side template injection in a rendered view
CISSP vs CISA: which one you actually qualify for
These two get shortlisted together and they are not interchangeable. CISSP is a security practitioner and leadership credential from ISC2; CISA is an audit and assurance credential from ISACA. The deciding factor for most people is not the syllabus, it is the experience rule and what happens if you do not meet it yet.
| CISSP (ISC2) | CISA (ISACA) | |
|---|---|---|
| Exam format | Adaptive (CAT), 100 to 150 items | 150 multiple-choice |
| Time limit | 3 hours | 4 hours |
| Pass mark | 700 of 1000 | 450 on a 200 to 800 scale |
| Exam price (USD) | $749 | $575 member, $760 non-member |
| Experience required | 5 years across 2 or more of the 8 domains | 5 years within the past 10 years |
| Minimum you cannot waive | 4 years | 2 years |
| Waiver available | Up to 1 year: a degree OR an approved credential, not both | Up to 3 years: degree, CIMA or ACCA |
| If you lack the experience | Pass anyway and become an Associate of ISC2, then 6 years to earn it | Pass anyway, then 5 years to apply |
| After you pass | Endorsement by a certified professional within 9 months | Supervisor-verified application plus a $50 fee |
| Annual fee | $135 | $45 member, $85 non-member |
| Continuing education | 120 CPEs per 3 years, 90 of them Group A | 120 CPEs per 3 years, minimum 20 a year |
| Retake waits | 30, then 60, then 90 days | 30, then 90, then 90 days |
| Attempts per 12 months | 4 | 4 |
| Languages | 5 | 7 |
Sources: the ISC2 CISSP Exam Outline effective 15 April 2024, ISC2 exam pricing and member policies, the ISACA CISA Exam Content Outline, and the ISACA Certification Exams Candidate Guide. Note that ISC2 has a stale notice page still quoting 125 to 175 items over 4 hours; the current outline supersedes it. PrepClubs is not affiliated with ISC2 or ISACA.
The parts of CISSP that catch people out, and none of them are the syllabus
Passing the exam does not make you a CISSP
CISSP needs five years of cumulative paid work across two or more of the eight domains. You can shave one year off with a post-secondary degree in a computing field, or one year with an approved credential from the ISC2 list, but not both. Only one year can ever be waived, so four years is the floor nobody gets under.
Note that the approved-credential list changed on 1 April 2026. ISC2 now requires a waiver credential to have a publicly available exam outline, ANAB ISO/IEC 17024 accreditation, and at least 90 percent alignment with two or more CISSP domains. Credentials that failed the test were removed and the list now holds 23. If you were counting on a specific certification to buy you that year, check it is still listed.
If you do not have the experience, you can still sit and pass, which makes you an Associate of ISC2 with six years to earn the five years required. Part-time counts if you work 20 to 34 hours a week, where 1,040 hours reads as six months. Paid and unpaid internships both count with documentation.
Then there is a step most people do not budget for: endorsement. Your application has to be endorsed and digitally signed by an ISC2 certified professional in good standing, within nine months of passing. ISC2 will act as endorser if you do not know one, but the nine-month clock is real.
What it costs, including the years after
The exam is $749 in the Americas, Asia Pacific, and the Middle East and Africa. EMEA is EUR 719.04 and the UK is GBP 606.69. Rescheduling costs $50 and cancelling costs $100, both worth knowing before you book a date you are not sure about.
After certification the annual maintenance fee is $135 a year. Associates and candidates pay $50. Across a three-year cycle that is $405 on top of the exam, so the first three years of holding CISSP cost about $1,154 before any training.
Continuing education is 120 CPE credits per three-year cycle, and the split matters: 90 must be Group A, directly related to the domains, with the remaining 30 from either group. ISC2 suggests 40 a year as a working pace. Miss the deadline and there is a 90-day grace period, then suspension, and suspension can run at most two consecutive years before the certification is terminated.
Adaptive scoring changes how you should sit it
Since April 2024 every language is delivered as computerized adaptive testing. The exam runs between 100 and 150 items in a maximum of three hours, and 25 of the items in a minimum-length exam are unscored pretest items you cannot identify.
Adaptive delivery means you cannot return to a previous question, so the flag-and-revisit habit that works on a linear exam is unavailable. It also means a short exam is not a bad sign: the algorithm stops as soon as it is confident, in either direction.
Anyone telling you the CISSP is 250 questions over six hours is quoting pre-2024 material. That format no longer exists in any language, and a study plan built around it will pace you wrongly.
What ISC2 says about pay, and what it does not say
ISC2 publishes an average of $147,757 for North America and $119,577 globally, attributed to its own Cybersecurity Workforce Study. We will flag what ISC2 does not: the page does not name which edition of the study the figures come from, so they are undated.
Treat them as what they are, a professional body citing its own survey of people who already hold a senior security role. They are not a measure of what passing an exam adds to your salary, and nobody publishes that number honestly.
Build the rest of your prep stack
How CISSP is scored
The CISSP exam is Computerized Adaptive Testing (CAT). It serves 100 to 150 items in a maximum of 3 hours, and the algorithm re-estimates your ability after each answer, then serves a harder or easier next item. The passing standard is a scaled 700 out of 1000. Your result is reported as pass or fail only, with no numeric score returned to you.
Because scoring is adaptive and scaled, there is no fixed percentage that guarantees a pass. The exam ends when the algorithm is statistically confident you are above or below the standard, when the 3-hour limit is reached, or when the item pool is exhausted. A wide spread of question difficulty is what lets the algorithm decide, so practicing across easy, medium, and hard items matters more than chasing a single percentage.
Twenty-five of the delivered items are unscored pretest questions, embedded and indistinguishable from scored ones. You cannot tell which is which, so the only sound strategy is to reason carefully on every item. Our exam-mode forms are fixed 125-item full-length rehearsals that mirror the domain weighting, so your practice tracks the shape of the real exam even though we do not run a live adaptive engine.
Who uses the CISSP?
CISSP is a common benchmark for security manager, security architect, and senior analyst roles, and it satisfies a well-known baseline requirement for many U.S. defense and government positions at the management level. Organizations that hire for security leadership routinely list it as a requirement or a strong preference.
A CISSP prep approach (about 30 days)
Days 1-3: Take the free diagnostic and read your domain breakdown
Start with the free 25-question timed diagnostic. It scores you domain by domain across all eight domains so you can see exactly where you stand before spending a cent. Your two weakest domains become the focus of the plan.
Days 4-14: Study mode by domain, weakest first
Work through study mode one domain at a time, reading the rationale on every question including the ones you get right. Security and Risk Management is the largest domain and the judgment core, so do not leave it for last.
Days 15-24: Drill best-answer judgment
The CISSP trap is picking the sharpest technical fix when the stem calls for a governance or risk decision. Work the BEST, FIRST, and MOST effective items until the "think like a manager" reasoning (assess before act, policy before technology, protect the organization) is automatic.
Days 25-29: Full-length timed forms
Sit exam-mode forms under a strict clock. Aim to consistently clear a comfortable margin above the pass standard with time to spare, and review every miss by domain.
Day 30: Light review and rest
Review only your flagged and missed items from the last two forms. Do not cram new material the day before. Settled recall beats last-minute volume.
Common CISSP mistakes
Picking the most technical answer
CISSP credentials a security leader, not a hands-on technician. When the stem asks for a governance or risk decision, the sharpest technical fix is usually the trap. Train yourself to assess and advise before you act.
Ignoring the deciding keyword
The stem keyword (BEST, FIRST, NEXT, MOST effective) decides the answer. Read from the stem back to the options. If you pattern-match a familiar term in the options first, a well-built distractor will beat you.
Studying to an old outline
The exam moved to CAT for all languages on April 15, 2024, and Domain 1 rose to 16 percent while Domain 8 dropped to 10 percent. Free question dumps are often written to a retired outline and offer no rationale. Practice built to the current outline is what matters.
Underweighting the management domains
Hands-on candidates ace the network and operations material and then lose the exam on risk management, governance, and compliance. Security and Risk Management alone is 16 percent of the blueprint. Do not skip it.
Related reading
CISSP FAQs
A score tells you how you did. The coach tells you what to practice next.
After every test you get a short plan built from your own answers and seconds: which sections cost you points, which ones eat your clock, and the drill that fixes each.
Math: 11 of 12 right, at 31 s a question
Drill math against a 20 s clock. That frees about 2 minutes per test for the sections you miss more.
People who got the same questions right took 20 s.
Illustrative data
- Every section mapped on accuracy against speed, with one fix for each
- The questions that ate your time, and the clock checkpoints to hit next time
- Where rushing costs you, and the point to guess and move on
- A read that sharpens with every test you take
Your pacing report is free with your first test.
Prove you are ready before exam day.
A full CISSP bank: 10 timed forms, roughly 1,250 original questions, a rationale for every answer. Start free, then unlock it for $89.
Start prepping