ISC2 certification practice
Practise Certified Information Systems Security Professional CISSP practice test — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps. Courseiva helps you prepare with realistic practice questions, topic-based revision, explained answers and structured study routes.
New here? Start with this
Recommended: 10-question diagnostic
Covers all 8 domains · takes ~5 min · no account needed · shows your weak areas immediately
Key facts for the Certified Information Systems Security Professional CISSP exam.
Exam cost
$749 USD / ~£600
Duration
Up to 240 minutes (4 hours) — CAT format
Question count
100–150 questions (CAT adaptive)
Passing score
700 / 1000
Validity
3 years
Delivered by
Pearson VUE
Online proctored
Yes — available
Retake policy
100% free — no account required
Everything on Courseiva for CISSP is free — no subscription, no trial, no email wall.
Courseiva provides free Certified Information Systems Security Professional CISSP (CISSP) practice questions with original exam-style questions, detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics. Courseiva is an independent platform and is not affiliated with ISC2.
30 days between first and second attempt; 90 days thereafter; 180 days after fourth attempt
Question formats
The ISC2 Certified Information Systems Security Professional (CISSP) is the most widely recognised and respected cybersecurity certification globally, validating deep expertise across eight security domains known as the Common Body of Knowledge (CBK). These domains span security and risk management, asset security, security architecture, network security, identity and access management, security assessment, security operations, and software development security. The CISSP uses Computerised Adaptive Testing (CAT) for English exams, adjusting question difficulty dynamically to assess competence more precisely. Earning the CISSP is a significant career milestone that opens doors to senior security architect, CISO, and security director roles worldwide.
Official prerequisite
Five years of cumulative paid work experience in two or more of the eight CISSP CBK domains. A four-year college degree or approved credential can waive one year of experience. Candidates without experience can pass as an Associate of ISC2.
Recommended experience
Broad hands-on experience in security roles; familiarity with all eight domains; prior certifications such as Security+, SSCP, or CISM are helpful but not required
5+ years in information security across multiple domains; most successful candidates have 7–10+ years of broad security experience
Should you skip this exam?
Skip if you have fewer than 3–4 years of hands-on security experience — consider Security+, SSCP, or CISM first to build the foundational breadth the CISSP demands
Courseiva study tip
Think like a manager, not a technician — CISSP questions often have two technically correct answers, and you must pick the one that best aligns with risk management, business objectives, and security governance principles
UK salary range
£80,000–£120,000
US salary range
$130,000–$180,000
Job roles that cite CISSP
What certification to take next
The CISSP exam costs $749 USD. After passing, an annual ISC2 membership fee of $125 USD applies to maintain the certification.
The English-language CISSP uses Computerised Adaptive Testing (CAT) and presents between 100 and 150 questions. The exam ends early if the system determines with statistical confidence that you have passed or failed. Linear (fixed-form) exams in other languages contain 250 questions.
The passing score is 700 out of 1000 on a scaled basis. Because the CAT format adapts to your performance, the score reflects competency across all domains rather than a simple percentage of correct answers.
The CISSP is widely considered one of the hardest IT certifications in existence, with pass rates estimated at around 20–30% on first attempt. The difficulty is not purely technical — the exam tests managerial judgement and the ability to prioritise risk-based decisions, which catches many technically strong candidates off guard.
No degree is required, but you do need five years of paid work experience in at least two of the eight CISSP domains. A four-year degree or certain approved credentials can substitute for one year of the experience requirement. Candidates without the experience can still pass and become an Associate of ISC2, then complete the experience within six years.
The CISSP is valid for three years. Renewal requires 120 CPE credits over the three-year cycle (at least 40 per year) and the annual ISC2 membership fee of $125.
The CISSP is most relevant for senior roles: Security Architect, Security Manager, CISO, Security Director, and Security Consultant. It is frequently listed as required or preferred in job postings for roles paying over $120,000 in the US and £80,000 in the UK.
See how CISSP stacks up against related certifications.
Practice modes
Choose a mode that matches your current study phase. Use topic practice early on and mock exams closer to your exam date.
All CISSP Questions
Browse the full question bank organised by domain and difficulty.
Practice Test
Start a session with detailed answer explanations after each question.
Mock Exam
Simulate the real exam with a timed, full-length question set.
Quick 10
A 10-question warm-up — ideal for a short daily study session.
Flashcards
Reinforce key terms, commands, and protocol facts with flashcards.
Domain Practice
Focus exclusively on one exam domain to target your weakest area.
50-Question Set
Mid-length practice set covering all domains.
Full-length Simulation
Full exam simulation matching the real question count.
Exam guide
Start with a short practice session, review each missed answer, then return to the topics that caused mistakes.
Certified Information Systems Security Professional CISSP questions test whether you can apply the concept in context, not just recognise a definition.
How the topic appears in realistic exam-style scenarios.
Which detail in the question changes the correct answer.
How to eliminate plausible but wrong options.
How to connect the question back to the wider exam objective.
Related practice questions
Use these internal links to move from the exam guide into focused topic practice pages.
Practise CISSP questions linked to Software Development Security.
Practise CISSP questions linked to Security Assessment and Testing.
Practise CISSP questions linked to Identity and Access Management.
Practise CISSP questions linked to Security and Risk Management.
Practise CISSP questions linked to Security Architecture and Engineering.
Practise CISSP questions linked to Communication and Network Security.
Practise CISSP questions linked to Asset Security.
Practise CISSP questions linked to Security Operations.
Practise CISSP questions linked to CISSP fundamentals.
Practise CISSP questions linked to CISSP scenario.
Practise CISSP questions linked to CISSP troubleshooting.
Practice directory
Every practice set is a unique selection of questions — numbered tests, domain-focused sessions, and topic-specific quizzes.
Showing 30 of 38 tests. See all 38 CISSP practice tests →
Timed mode
Official blueprint
Target weak areas by practising questions from a single domain. Each domain page shows all questions, difficulty breakdown, and a focused practice session.
Practise CISSP questions in this domain →
Practise CISSP questions in this domain →
Practise CISSP questions in this domain →
Practise CISSP questions in this domain →
Practise CISSP questions in this domain →
Practise CISSP questions in this domain →
Practise CISSP questions in this domain →
Practise CISSP questions in this domain →
Browser-based calculators and references used when studying for CISSP.
TCP/UDP Port Reference
Search 90+ well-known ports by name, number, or protocol — with exam context
Password Strength Checker
Entropy bits, character set, and crack time estimate — computed locally
Encryption Algorithm Reference
Symmetric, asymmetric, and hash algorithms — key sizes and exam context
Term reference
These terms appear frequently in CISSP questions. Understanding them precisely reduces guessing and improves scores.
Acceptable use policy
An acceptable use policy is a set of rules that an organization creates to define how employees and other users may use its computer systems, networks, and data.
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
Access key
An access key is a unique identifier and secret code pair used to authenticate requests to cloud storage services, ensuring only authorized users or applications can access data.
Access port
An access port is a switch port that connects to a single end device, like a computer or printer, and carries traffic for only one VLAN.
Access review
An access review is a periodic audit process where administrators check and confirm which users have permissions to what resources, ensuring only authorized people retain access.
Access token
A digital key that a computer system gives you to prove your identity and grant you permission to access specific resources or perform actions.
Alerting policy
An alerting policy is a set of rules that defines when to send notifications about a system condition that needs attention.
Anti-malware
Anti-malware is software that detects, prevents, and removes malicious software from computers, networks, and devices.
Free study guide
The Courseiva CISSP study guide covers exam format, the official domain blueprint with weights, a structured study plan, and domain-specific tips for each section. Use it alongside practice questions to build both conceptual depth and exam confidence.
Sample questions
Select your answer before revealing the explanation. These questions are original exam-style — not copied from any exam or dump site.
Trap 1: Network segmentation
Segmentation limits the blast radius but does not encrypt traffic; an attacker on the same segment could still intercept.
Trap 2: Intrusion prevention system (IPS)
IPS can detect and block certain attacks but does not encrypt traffic; prevention of interception requires encryption.
Trap 3: Strong password policies
Strong passwords authenticate users but do not protect data in transit from sniffing.
Encryption at the network layer (e.g., IPsec)
IPsec encrypts IP packets, making intercepted data unreadable without decryption keys.
Network segmentation
Why wrong: Segmentation limits the blast radius but does not encrypt traffic; an attacker on the same segment could still intercept.
Intrusion prevention system (IPS)
Why wrong: IPS can detect and block certain attacks but does not encrypt traffic; prevention of interception requires encryption.
Strong password policies
Why wrong: Strong passwords authenticate users but do not protect data in transit from sniffing.
Trap 1: SSH
SSH provides encryption for remote sessions, but it is a terminal protocol, not a general network security protocol like IPsec or TLS.
Trap 2: HMAC
HMAC provides integrity and authentication, not confidentiality.
Trap 3: AH in tunnel mode
AH does not encrypt; it only provides authentication and integrity.
SSH
Why wrong: SSH provides encryption for remote sessions, but it is a terminal protocol, not a general network security protocol like IPsec or TLS.
ESP in transport mode
ESP provides encryption, thus confidentiality.
HMAC
Why wrong: HMAC provides integrity and authentication, not confidentiality.
AH in tunnel mode
Why wrong: AH does not encrypt; it only provides authentication and integrity.
TLS 1.3
TLS encrypts application data, providing confidentiality.
Trap 1: Use private VLANs on all trunk ports.
Private VLANs isolate traffic within a VLAN but do not prevent VLAN hopping attacks.
Trap 2: Enable BPDU guard on all access ports.
BPDU guard protects against STP attacks, not VLAN hopping.
Trap 3: Implement port security on all access ports.
Port security limits MAC addresses per port but does not prevent VLAN hopping.
Use private VLANs on all trunk ports.
Why wrong: Private VLANs isolate traffic within a VLAN but do not prevent VLAN hopping attacks.
Set the native VLAN to an unused VLAN.
This prevents double-tagging attacks by ensuring the native VLAN is not used by any user traffic.
Enable BPDU guard on all access ports.
Why wrong: BPDU guard protects against STP attacks, not VLAN hopping.
Disable Dynamic Trunking Protocol (DTP) on trunk ports.
DTP can be exploited to negotiate trunks; disabling it prevents unauthorized trunk establishment.
Implement port security on all access ports.
Why wrong: Port security limits MAC addresses per port but does not prevent VLAN hopping.
Trap 1: Higher-than-normal network traffic
More indicative of data exfiltration or C2.
Trap 2: System performance degradation
Too generic; can have many causes.
Creation of new user accounts with administrative privileges
Often used to maintain persistence after escalation.
Higher-than-normal network traffic
Why wrong: More indicative of data exfiltration or C2.
System performance degradation
Why wrong: Too generic; can have many causes.
Modification of system files or registry keys
Common after successful escalation to achieve persistence.
Unusual processes running under elevated privileges
Could indicate exploitation of local privilege escalation.
Trap 1: Logging and monitoring
Monitoring detects incidents but does not prevent them.
Trap 2: Periodic access reviews
Reviews ensure proper permissions but do not prevent initial unauthorized access.
Trap 3: Regular vulnerability scanning
Scanning identifies weaknesses but does not prevent access directly.
Logging and monitoring
Why wrong: Monitoring detects incidents but does not prevent them.
Encryption in transit and at rest
Encryption renders data unreadable without keys, preventing unauthorized access.
Periodic access reviews
Why wrong: Reviews ensure proper permissions but do not prevent initial unauthorized access.
Regular vulnerability scanning
Why wrong: Scanning identifies weaknesses but does not prevent access directly.
Trap 1: The length of the third-party data processing agreement
The agreement term may affect retention but not the primary driver.
Trap 2: The cost of storage media
Cost is not a compliance factor; data must be retained for legal/regulatory reasons.
Trap 3: The duration of any pending legal holds
Legal holds may extend retention, but the base retention is determined by purpose.
The length of the third-party data processing agreement
Why wrong: The agreement term may affect retention but not the primary driver.
The purpose for which the data was collected
GDPR's storage limitation principle requires retention no longer than necessary for processing purposes.
The cost of storage media
Why wrong: Cost is not a compliance factor; data must be retained for legal/regulatory reasons.
The duration of any pending legal holds
Why wrong: Legal holds may extend retention, but the base retention is determined by purpose.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.