20+ practice questions focused on Security and Risk Management — one of the most tested topics on the Certified Information Systems Security Professional CISSP exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Security and Risk Management PracticeWhich THREE of the following are data subject rights under the GDPR? (Select THREE)
Explanation: The GDPR grants data subjects specific rights, which include the right to object to processing (Article 21), the right to data portability (Article 20), and the right to erasure (Article 17). The 'Right to data ownership' and 'Right to remuneration' are not recognized GDPR data subject rights.
A security analyst is evaluating risks using a qualitative matrix. The likelihood is rated as 'high' and the impact as 'medium'. What is the overall risk level typically assigned in a 3x3 matrix?
Explanation: Qualitative risk matrices are not universally standardized. For example, in some 3x3 matrices (such as a simple multiplicative 1-3 scale where Low=1, Med=2, High=3), High (3) x Medium (2) equals 6, which falls into the 'Medium' band (typically 4-6). In other frameworks, like NIST SP 800-30, High x Medium maps to 'High'. Because CISSP is a vendor-neutral exam that does not mandate a single proprietary risk matrix layout, this question is highly subjective and ambiguous.
Which THREE of the following are elements of the AAA framework in security?
Explanation: The AAA framework in security consists of three core elements: Authentication (verifying identity), Authorization (granting permissions), and Accounting (tracking user activities and resource usage). Therefore, options A, B, and C are the correct three elements.
According to the ISC2 Code of Ethics, which TWO canons are listed in the correct order of priority (highest to lowest)?
Explanation: The ISC2 Code of Ethics canons must be observed in the following strict order of priority: 1. Protect society, the common good, necessary public trust and confidence, and the infrastructure. 2. Act honorably, honestly, justly, responsibly, and legally. 3. Provide diligent and competent service to principals. 4. Advance and protect the profession.
An organization is implementing a new access control system. Which of the following represents the correct order of the AAA framework components?
Explanation: The AAA framework stands for Authentication, Authorization, and Accounting, in that order. First, a user's identity is verified, then permissions are checked, and finally activities are logged.
+15 more Security and Risk Management questions available
Practice all Security and Risk Management questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Security and Risk Management. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Security and Risk Management questions on the CISSP frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Security and Risk Management is tested as part of the Certified Information Systems Security Professional CISSP blueprint. Practicing with targeted Security and Risk Management questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free CISSP practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Security and Risk Management is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Security and Risk Management practice session with instant scoring and detailed explanations.
Start Security and Risk Management Practice →