CISSP Practice Exam Free Online — 500+ Questions Covering All 8 Domains (2026)

B is correct. This is the manager mindset in action. A security leader with limited resources must prioritize based on risk — specifically the likelihood × impact of each vulnerability against the organization's critical assets. CVSS scores matter, but business context matters more. A critical CVE on an isolated test system may be lower priority than a medium-severity vulnerability on a customer-facing payment server. Option A ignores risk prioritization. Option C is operationally unrealistic as a first step. Option D ignores risk entirely. Risk-based prioritization is one of the most fundamental CISSP concepts.

A is correct. Containment is the critical first step — isolate to prevent the ransomware from spreading to other systems. Option B (restore from backup) comes AFTER containment and eradication to ensure you're not reinfecting a clean system from a still-live threat. Option C (shut down) would destroy volatile evidence in RAM (network connections, running processes, encryption keys potentially in memory) — important for forensics. Option D (pay ransom) is never the recommended security response and does not guarantee file restoration. The incident response lifecycle: Prepare → Identify → CONTAIN → Eradicate → Recover → Lessons Learned.

C is correct. Digital signatures provide both integrity (the update hasn't been changed) AND authentication (it came from the legitimate vendor). The vendor signs with their private key; clients verify with the vendor's public key via PKI. Option A (symmetric encryption) provides confidentiality only — no authentication of origin. Option B (SHA-256 hash published on website) only verifies integrity IF you trust the website hasn't been compromised too — and it doesn't authenticate the source. Option D (encrypt with recipient's public key) provides confidentiality to each recipient but doesn't authenticate the sender and doesn't scale to thousands of clients. Digital signatures = integrity + non-repudiation + authentication. Classic CISSP question.

D is correct. The principle of least privilege states that users should receive the MINIMUM access required to perform their specific job function. Granting a new employee the same access as a senior employee — who has accumulated access over years — violates least privilege. The new employee likely needs access to specific systems to start, not everything the senior employee can access. Option A (separation of duties) means no single person can complete a sensitive transaction alone — not relevant here. Option C (need to know) is closely related to least privilege but specifically about information classification access, while least privilege applies to all access broadly. The correct answer is D.

B is correct. Recovery Time Objective (RTO) is the maximum acceptable time to restore a system after a failure — in this case, 2 hours. Recovery Point Objective (RPO) is about data: the maximum acceptable data loss expressed as a time period (e.g., "we can lose up to 4 hours of transaction data"). MTD (C) is the maximum time the business can survive without the system before the impact becomes catastrophic — MTD is always ≥ RTO. MTTR (D) is a reliability metric (actual average time to repair), not a business continuity planning objective. RTO vs RPO is heavily tested on CISSP — know them both cold.

C is correct. DevSecOps integrates security throughout every phase of the SDLC — from design through development, testing, and deployment. Security is embedded in the CI/CD pipeline: automated static code analysis (SAST), dependency scanning, container security checks, secrets detection. This is "shifting security left" — finding and fixing issues earlier when they're cheaper to fix. Option A (pen test before deployment) is security bolted on at the end — exactly what the CISO wants to move away from. Option B (bug bounty) is a valuable supplementary program, not a core SDLC security approach. Option D (review board) creates a bottleneck and doesn't scale with modern development velocity. DevSecOps is the modern CISSP-aligned answer for SDLC security integration.