How many Select Two (Multi-Select) Questions questions are on this page?

This page has 20 Select Two (Multi-Select) Questions scenario questions for the CISSP exam, each with detailed explanations and wrong-answer analysis.

How should I approach CISSP scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Certified Information Systems Security Professional CISSP questions

Scenario-based practice

Select Two (Multi-Select) Questions

Practise Certified Information Systems Security Professional CISSP practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

CISSP

exam code

ISC2

vendor

Scenario guide

How to approach select two (multi-select) questions

Multi-select questions tell you to 'Choose TWO' or 'Choose THREE'. Getting partial credit is not a thing — you must select all correct answers with no incorrect ones. The stem always states how many to choose, so trust it. These questions require precision, not best-guess elimination.

Quick answer

Select Two (Multi-Select) Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1easymulti select

Full question →

Which TWO options are valid methods for providing confidentiality in network communications? (Choose two.)

A
SSH
Why wrong: SSH provides encryption for remote sessions, but it is a terminal protocol, not a general network security protocol like IPsec or TLS.
B
ESP in transport mode
ESP provides encryption, thus confidentiality.
C
HMAC
Why wrong: HMAC provides integrity and authentication, not confidentiality.
D
AH in tunnel mode
Why wrong: AH does not encrypt; it only provides authentication and integrity.
E
TLS 1.3
TLS encrypts application data, providing confidentiality.

Select Two (Multi-Select) Questions

How to approach select two (multi-select) questions

Quick answer

Related CISSP topic practice pages

Software Development Security practice questions

Security Assessment and Testing practice questions

Identity and Access Management practice questions

Security and Risk Management practice questions

Security Architecture and Engineering practice questions

Communication and Network Security practice questions

Asset Security practice questions

Security Operations practice questions

CISSP fundamentals practice questions

CISSP scenario practice questions

CISSP troubleshooting practice questions

Practice scenarios

Which TWO options are valid methods for providing confidentiality in network communications? (Choose two.)

A network administrator is configuring switches to prevent VLAN hopping attacks. Which TWO of the following measures should be implemented?

Which THREE of the following are common indicators of a privilege escalation attack? (Choose three.)

Which TWO of the following are considered the primary access control models in the context of the CISSP? (Select two.)

A security analyst is reviewing an organization's password policy. Which THREE of the following are considered best practices for password security according to current NIST guidelines? (Select three.)

Which TWO of the following are common causes of network performance degradation that can be detected by network monitoring tools?

Which TWO are common techniques to defend against VLAN hopping attacks? (Choose two.)

Which three BGP security mechanisms help protect against route hijacking? (Choose THREE.)

During a security assessment, an organization wants to ensure that its web application is resistant to common attacks. Which THREE testing types should be included?

Which TWO of the following are common techniques used in dynamic application security testing (DAST)?

Which THREE are key components of a business continuity plan (BCP)?

Which TWO of the following are essential components of a data classification policy? (Select two.)

Which THREE of the following are common methods used in security assessment and testing? (Select exactly 3.)

Which TWO of the following are key components of an Information Security Governance framework? (Select exactly 2)

Which THREE of the following are valid risk treatment options according to ISO 31000? (Select exactly 3)

Which TWO of the following are examples of physical security controls?

Which TWO of the following are principles of the Bell-LaPadula security model?

Which THREE of the following are valid countermeasures against buffer overflow attacks?

Which TWO of the following are valid reasons to implement network segmentation?

Which THREE of the following are characteristics of a federated identity management system?