Courseiva
Free · No account needed · No credit card

(ISC)2 Information Systems Security Management Professional (CISSP-ISSMP, Aug 2025 blueprint) (ISC) Practice Test

266 questions with instant explanations, domain breakdown, and wrong-answer analysis. Built for the real exam.

Instant feedback after each answer
Full explanations included
Domain score breakdown
Real exam: 180 min
Pass mark: 700 out of 1,000

Sample questions with explanations

This is exactly what you see during practice — question, options, and a full explanation after you answer.

Q1Contingency Managementmedium
Full explanation →

Your organization uses a 'Warm Site' for its disaster recovery strategy. During a recent audit, you find that the site lacks the necessary bandwidth to support peak production traffic. What is the most appropriate management response?

ACancel the warm site contract and build a cold site.
BRequire all employees to work from home during a disaster to save bandwidth.
CAccept the risk formally via the Risk Register without further mitigation.
Update the DRP to include a 'throttling' policy for non-critical services during failover.Correct

A warm site is a partially equipped recovery facility that requires some configuration and data restoration before it can take over. If the site lacks bandwidth for peak traffic, the pragmatic management response is to update the DRP to define which services get priority bandwidt…Read full explanation

Q2Contingency Managementhard
Full explanation →

Following a ransomware attack, the organization must decide whether to invoke the DRP or remain in a degraded state while security teams perform forensics. What is the ISSMP's primary responsibility in this decision-making process?

AChoosing the restore point from the offsite immutable backup.
Ensuring the decision is documented to align with the organization's risk appetite.Correct
CPerforming the initial forensic image of the infected servers.
DDirecting the IT team to disconnect the network immediately.

The ISSMP operates at the management and governance layer, not the hands-on technical layer. When deciding between invoking the DRP and staying degraded for forensics, the ISSMP's primary duty is to ensure the decision is made deliberately, documented, and aligned with the organi…Read full explanation

Q3Contingency Managementmedium
Full explanation →

You are auditing a third-party disaster recovery service provider. Which metric provides the most accurate evidence that the provider can meet your organization's required recovery point for a database cluster?

AMean Time to Recovery (MTTR) reports from previous tests.
BService Level Agreement (SLA) uptime percentages.
Replication Lag monitoring logs showing synchronization latency.Correct
DAnnual penetration test results.

Replication lag directly measures the time delay between a write on the primary database and its application on the replica. Since the recovery point objective (RPO) defines the maximum tolerable data loss measured in time, replication lag is the precise indicator of how much dat…Read full explanation

What's covered

Questions are tagged by exam domain. Practice a specific domain or mix them all.

Untimed Practice

Answer at your own pace. Explanation and domain tag shown immediately after each answer.

Timed Practice

Countdown timer starts immediately. Results and domain scores shown at the end — just like the real exam.

Why practice here?

Full explanations on every question

Not just the right answer — you get exactly why each wrong option is wrong, so you learn the concept, not the answer.

Domain score breakdown

After each session see your score by exam domain so you know exactly where to focus study time.

100% free, forever

No subscription, no trial, no email wall. Start a session in under 10 seconds.

Exam-style questions

Scenario-based, precise wording, realistic distractors — written to match what you actually see on exam day.

← All ISC questionsISC exam guideStudy guidePractice by domain