How should I use these Identity and Access Management practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Identity and Access Management questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Identity and Access Management domain.

CISSP · topic practice

Identity and Access Management practice questions

Practise Certified Information Systems Security Professional CISSP Identity and Access Management practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Identity and Access Management

Practice 10 questions Browse domain →

What the exam tests

What to know about Identity and Access Management

Identity and Access Management questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Identity and Access Management exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Identity and Access Management questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full NAT/PAT explanation →

A healthcare organization implements a policy requiring all employees to use biometric fingerprint scanners to access patient records. Which of the following is the MOST significant risk associated with this authentication method?

Trap 1: High false acceptance rate leading to unauthorized access

Modern fingerprint scanners have very low FAR.

Trap 2: Low user acceptance due to privacy concerns

Healthcare workers generally accept biometrics for security reasons.

Trap 3: Increased login time compared to password authentication

Fingerprint scanning is usually faster than typing a password.

Study all Identity and Access Management common traps →

A
Biometric data cannot be revoked or changed if compromised
Biometric traits are permanent; once stolen, they cannot be replaced.
B
High false acceptance rate leading to unauthorized access
Why wrong: Modern fingerprint scanners have very low FAR.
C
Low user acceptance due to privacy concerns
Why wrong: Healthcare workers generally accept biometrics for security reasons.
D
Increased login time compared to password authentication
Why wrong: Fingerprint scanning is usually faster than typing a password.

Full breakdown with real-world context →

Question 2hardmultiple choice

Read the full NAT/PAT explanation →

A multinational corporation deploys a single sign-on (SSO) solution using SAML 2.0 across all subsidiaries. Recently, users in one subsidiary report being unable to access an internal application. The identity provider (IdP) logs show successful authentication, but the service provider (SP) logs indicate assertion validation failures. Which of the following is the MOST likely cause?

Trap 1: The SP is configured to require a specific SAML attribute not…

Missing attribute would cause authorization failure, not assertion validation failure.

Trap 2: The IdP server for the subsidiary is temporarily unreachable

If unreachable, authentication would fail at IdP side.

Trap 3: The SAML certificate used by the SP has expired

Expired certificate would cause failures for all users, not just one subsidiary.

Study all Identity and Access Management common traps →

A
The system clocks on the IdP and SP are significantly out of sync
SAML assertions include timestamps; clock skew leads to validation failure.
B
The SP is configured to require a specific SAML attribute not present in the assertion
Why wrong: Missing attribute would cause authorization failure, not assertion validation failure.
C
The IdP server for the subsidiary is temporarily unreachable
Why wrong: If unreachable, authentication would fail at IdP side.
D
The SAML certificate used by the SP has expired
Why wrong: Expired certificate would cause failures for all users, not just one subsidiary.

Full breakdown with real-world context →

Question 3easymultiple choice

Read the full Identity and Access Management explanation →

An organization wants to implement a password policy that balances security and usability. Which of the following is the BEST practice according to current NIST guidelines?

Trap 1: Set maximum password length to 8 characters

NIST recommends allowing at least 64 characters.

Trap 2: Require password changes every 30 days

NIST advises against periodic changes without evidence of compromise.

Trap 3: Enforce a minimum of one uppercase, one lowercase, one digit, and…

NIST no longer recommends composition rules.

Study all Identity and Access Management common traps →

A
Compare new passwords against a list of known compromised passwords
This prevents use of common passwords from breach data.
B
Set maximum password length to 8 characters
Why wrong: NIST recommends allowing at least 64 characters.
C
Require password changes every 30 days
Why wrong: NIST advises against periodic changes without evidence of compromise.
D
Enforce a minimum of one uppercase, one lowercase, one digit, and one special character
Why wrong: NIST no longer recommends composition rules.

Full breakdown with real-world context →

Question 4mediummultiple choice

Read the full Identity and Access Management explanation →

A company uses Role-Based Access Control (RBAC) for its ERP system. A user in the 'Accounts Payable' role needs to temporarily approve purchase orders up to $10,000 while the 'Purchasing Manager' is on leave. What is the BEST way to grant this access?

Trap 1: Share the Purchasing Manager's account credentials with the user

Credential sharing violates security policy and audit trails.

Trap 2: Modify the 'Accounts Payable' role to include purchase order…

This permanently expands the role's privileges, violating least privilege.

Trap 3: Create a new role with the exact permissions needed and assign it…

Unnecessary administrative overhead; temporary assignment is more efficient.

Study all Identity and Access Management common traps →

A
Share the Purchasing Manager's account credentials with the user
Why wrong: Credential sharing violates security policy and audit trails.
B
Temporarily assign the 'Purchasing Approver' role to the user with an expiration date
This grants needed access for a limited time, maintaining least privilege.
C
Modify the 'Accounts Payable' role to include purchase order approval permissions
Why wrong: This permanently expands the role's privileges, violating least privilege.
D
Create a new role with the exact permissions needed and assign it to the user
Why wrong: Unnecessary administrative overhead; temporary assignment is more efficient.

Full breakdown with real-world context →

Question 5hardmultiple choice

Read the full Identity and Access Management explanation →

A security analyst discovers that a service account in Active Directory has not had its password changed in 5 years and has domain admin privileges. The account is used by a legacy application that does not support modern authentication protocols. Which of the following is the MOST secure approach to manage this account?

Trap 1: Convert the account to a group Managed Service Account (gMSA)

gMSA is not supported by legacy applications; also requires domain functional level.

Trap 2: Set a very long, complex password and store it in a password manager

Still a static password; manual rotation is not enforced.

Trap 3: Disable the account and create a new service account with limited…

Disabling breaks the application; new account may also need domain admin.

Study all Identity and Access Management common traps →

A
Convert the account to a group Managed Service Account (gMSA)
Why wrong: gMSA is not supported by legacy applications; also requires domain functional level.
B
Set a very long, complex password and store it in a password manager
Why wrong: Still a static password; manual rotation is not enforced.
C
Decommission the legacy application and migrate to a modern alternative that supports secure authentication
Eliminates the risk entirely by removing the service account.
D
Disable the account and create a new service account with limited privileges
Why wrong: Disabling breaks the application; new account may also need domain admin.

Full breakdown with real-world context →

Question 6easymultiple choice

Read the full NAT/PAT explanation →

A company wants to implement multi-factor authentication (MFA) for remote access. Which combination of factors represents something you have and something you are?

Trap 1: Password and PIN

Both are knowledge factors.

Trap 2: Hardware token and mobile phone

Both are possession factors.

Trap 3: Password and SMS code

Password (knowledge) + SMS (possession) is two factors but not 'have' and 'are'.

Study all Identity and Access Management common traps →

A
Password and PIN
Why wrong: Both are knowledge factors.
B
Hardware token and mobile phone
Why wrong: Both are possession factors.
C
Smart card and fingerprint
Smart card (possession) + fingerprint (inherence) = two factors.
D
Password and SMS code
Why wrong: Password (knowledge) + SMS (possession) is two factors but not 'have' and 'are'.

Full breakdown with real-world context →

Question 7mediummultiple choice

Read the full Identity and Access Management explanation →

An organization uses OAuth 2.0 for delegated access to APIs. A developer creates a public client application that runs on mobile devices. Which OAuth 2.0 grant type is MOST appropriate for this scenario?

Trap 1: Client Credentials Grant

Used for machine-to-machine, not user delegation.

Trap 2: Implicit Grant

Deprecated; less secure for mobile apps.

Trap 3: Resource Owner Password Credentials Grant

Not recommended; requires direct credential handling.

Study all Identity and Access Management common traps →

A
Client Credentials Grant
Why wrong: Used for machine-to-machine, not user delegation.
B
Implicit Grant
Why wrong: Deprecated; less secure for mobile apps.
C
Resource Owner Password Credentials Grant
Why wrong: Not recommended; requires direct credential handling.
D
Authorization Code Grant with PKCE
Provides secure token exchange for public clients.

Full breakdown with real-world context →

Question 8hardmulti select

Read the full Identity and Access Management explanation →

Which TWO of the following are valid methods to enforce separation of duties in an access control system?

Trap 1: Requiring mandatory vacations for all employees

Detective control, not enforcement.

Trap 2: Performing job rotation every six months

Deterrent, not direct enforcement.

Trap 3: Configuring shared accounts for each department

Shared accounts remove individual accountability.

Study all Identity and Access Management common traps →

A
Requiring mandatory vacations for all employees
Why wrong: Detective control, not enforcement.
B
Using time-based restrictions to prevent overlapping tasks
Can enforce that two actions cannot be done by same user in same time window.
C
Performing job rotation every six months
Why wrong: Deterrent, not direct enforcement.
D
Configuring shared accounts for each department
Why wrong: Shared accounts remove individual accountability.
E
Implementing role-based access control with mutually exclusive roles
Prevents a single user from having conflicting roles.

Full breakdown with real-world context →

Question 9mediummulti select

Read the full Identity and Access Management explanation →

Which THREE of the following are characteristics of a federated identity management system?

Trap 1: It operates with a single identity provider for all organizations

Multiple IdPs can be involved.

Trap 2: It requires all participating organizations to use the same user…

Federation works across different directories.

Study all Identity and Access Management common traps →

A
It relies on standard protocols such as SAML or OpenID Connect
Essential for interoperability.
B
It operates with a single identity provider for all organizations
Why wrong: Multiple IdPs can be involved.
C
It requires all participating organizations to use the same user directory
Why wrong: Federation works across different directories.
D
It enables identity information to be shared across different security domains
Core purpose of federation.
E
It provides single sign-on (SSO) across multiple organizations
Key benefit of federation.

Full breakdown with real-world context →

Question 10easymulti select

Read the full Identity and Access Management explanation →

Which TWO of the following are types of access control models?

Trap 1: SAML

A federation protocol.

Trap 2: Kerberos

An authentication protocol.

Trap 3: LDAP

A directory access protocol.

Study all Identity and Access Management common traps →

A
Discretionary Access Control (DAC)
An access control model.
B
SAML
Why wrong: A federation protocol.
C
Kerberos
Why wrong: An authentication protocol.
D
Role-Based Access Control (RBAC)
An access control model.
E
LDAP
Why wrong: A directory access protocol.

Full breakdown with real-world context →

Question 11mediummultiple choice

Read the full Identity and Access Management explanation →

Refer to the exhibit. A user reports they cannot authenticate to a web application after receiving a new token. The error log shows the above entries. Which of the following is the MOST likely cause?

Exhibit

Refer to the exhibit.

Error Log:
2024-05-20 14:23:01 ERROR [com.example.auth] Authentication failed for user 'jsmith' from IP 192.168.1.100: Invalid token signature
2024-05-20 14:23:01 ERROR [com.example.auth] Token validation failed: JWT signature does not match locally computed signature

Trap 1: The token uses a different signing algorithm than expected

Would show 'unexpected algorithm' error.

Trap 2: The token has expired

Would show 'token expired' error, not signature mismatch.

Trap 3: The token's issuer claim does not match the expected issuer

Would show 'invalid issuer' error.

Study all Identity and Access Management common traps →

A
The token uses a different signing algorithm than expected
Why wrong: Would show 'unexpected algorithm' error.
B
The token has expired
Why wrong: Would show 'token expired' error, not signature mismatch.
C
The token's issuer claim does not match the expected issuer
Why wrong: Would show 'invalid issuer' error.
D
The token was signed with a different secret key than the one used by the verifier
Signature mismatch indicates key mismatch.

Full breakdown with real-world context →

Question 12hardmultiple choice

Read the full Identity and Access Management explanation →

Refer to the exhibit. A user 'jdoe' is a member of the Domain Users group but not of the Administrators or Remote Desktop Users groups. The user reports they cannot log on locally to a domain-joined Windows server, but they can log on via RDP. Based on the GPO results, what is the MOST likely reason?

Exhibit

Refer to the exhibit.

Active Directory Group Policy Result:
Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment:
- Allow log on locally: Administrators, Users
- Deny log on locally: (empty)
- Allow log on through Remote Desktop Services: Administrators
- Deny log on through Remote Desktop Services: (empty)

Effective Access for user 'jdoe' (member of Domain Users):
- Log on locally: Denied (via membership in 'Remote Desktop Users' group? No)
- Log on through RDP: Not explicitly allowed or denied.

Trap 1: The user is a member of the Remote Desktop Users group

User is not a member of that group according to scenario.

Trap 2: The user is a member of a group that is denied local logon

Deny log on locally is empty.

Trap 3: The user is denied logon through Remote Desktop Services

Deny RDP is empty; user can RDP.

Study all Identity and Access Management common traps →

A
The user is a member of the Remote Desktop Users group
Why wrong: User is not a member of that group according to scenario.
B
The user is not a member of the local Users group or Administrators group
Domain Users are not in the local Users group; local logon is only allowed for Administrators and local Users.
C
The user is a member of a group that is denied local logon
Why wrong: Deny log on locally is empty.
D
The user is denied logon through Remote Desktop Services
Why wrong: Deny RDP is empty; user can RDP.

Full breakdown with real-world context →

Question 13hardmultiple choice

Read the full Identity and Access Management explanation →

A medium-sized financial services company recently deployed a new identity governance and administration (IGA) solution to manage user access across on-premises Active Directory and cloud-based SaaS applications. The IGA system uses a role-based access control (RBAC) model with hundreds of roles defined. The company has a policy that all access certifications must be completed quarterly. During the first quarterly certification, the access reviewers complain that they are overwhelmed by the number of entitlements they need to review, and many certifications are not completed on time. The security team also notices that some users have accumulated excessive privileges because role assignments were not properly reviewed. The company wants to streamline the certification process without sacrificing security. Which of the following is the BEST course of action?

Trap 1: Increase the certification frequency to monthly and assign more…

More frequent certifications increase workload; more reviewers may not solve the underlying issue of entitlement overload.

Trap 2: Eliminate role-based access and assign permissions directly to users

Direct assignment leads to even more entitlements and makes certification harder.

Trap 3: Automate all certifications by using scripts that approve access if…

Automation without human review can miss risky access and violates audit requirements.

Study all Identity and Access Management common traps →

A
Increase the certification frequency to monthly and assign more reviewers
Why wrong: More frequent certifications increase workload; more reviewers may not solve the underlying issue of entitlement overload.
B
Eliminate role-based access and assign permissions directly to users
Why wrong: Direct assignment leads to even more entitlements and makes certification harder.
C
Implement a risk-based certification approach that focuses on high-risk access and uses automated certification for low-risk access
Reduces reviewer workload while maintaining security on critical access.
D
Automate all certifications by using scripts that approve access if no violations are detected
Why wrong: Automation without human review can miss risky access and violates audit requirements.

Full breakdown with real-world context →

Question 14mediumdrag order

Read the full NAT/PAT explanation →

Drag and drop the steps for implementing a digital signature using asymmetric cryptography in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 15mediummatching

Read the full Identity and Access Management explanation →

Match each access control type to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Owner controls access permissions

System-enforced based on labels

Access based on job roles

Access based on rules and policies

Question 16easymultiple choice

Read the full Identity and Access Management explanation →

A company requires employees to authenticate using a smart card and PIN to access the corporate network. This is an example of which type of authentication?

Trap 1: Single-factor authentication

Only one factor is used, not matching the smart card and PIN.

Trap 2: Biometric authentication

Biometrics use something you are, not applicable here.

Trap 3: Single sign-on

SSO allows access to multiple systems after one authentication, but does not define factor type.

Study all Identity and Access Management common traps →

A
Single-factor authentication
Why wrong: Only one factor is used, not matching the smart card and PIN.
B
Biometric authentication
Why wrong: Biometrics use something you are, not applicable here.
C
Two-factor authentication
Correct – smart card (something you have) and PIN (something you know) are two distinct factors.
D
Single sign-on
Why wrong: SSO allows access to multiple systems after one authentication, but does not define factor type.

Full breakdown with real-world context →

Question 17mediummultiple choice

Read the full Identity and Access Management explanation →

A security architect is designing access controls for a healthcare application where permissions are based on the user's role, the sensitivity of the data, and the context of the access (e.g., time of day). Which access control model best fits this requirement?

Trap 1: Role-Based Access Control (RBAC)

RBAC assigns permissions based solely on roles, not on additional attributes like context.

Trap 2: Mandatory Access Control (MAC)

MAC uses classification labels and clearances, not dynamic attributes.

Trap 3: Discretionary Access Control (DAC)

DAC allows owners to set permissions, not suitable for context-based decisions.

Study all Identity and Access Management common traps →

A
Role-Based Access Control (RBAC)
Why wrong: RBAC assigns permissions based solely on roles, not on additional attributes like context.
B
Mandatory Access Control (MAC)
Why wrong: MAC uses classification labels and clearances, not dynamic attributes.
C
Attribute-Based Access Control (ABAC)
ABAC evaluates multiple attributes including user role, data sensitivity, and environment context.
D
Discretionary Access Control (DAC)
Why wrong: DAC allows owners to set permissions, not suitable for context-based decisions.

Full breakdown with real-world context →

Question 18hardmultiple choice

Read the full Identity and Access Management explanation →

An organization is implementing federated identity to allow partners to access its web application. The solution must support single logout and attribute exchange. Which protocol is most appropriate?

Trap 1: OpenID Connect

OpenID Connect provides authentication but has limited support for attribute exchange and single logout compared to SAML.

Trap 2: LDAP

LDAP is a directory protocol, not a federation protocol for SSO.

Trap 3: OAuth 2.0

OAuth 2.0 is an authorization framework, not designed for authentication or single logout.

Study all Identity and Access Management common traps →

A
SAML 2.0
SAML 2.0 is a mature protocol with built-in single logout and attribute query capabilities.
B
OpenID Connect
Why wrong: OpenID Connect provides authentication but has limited support for attribute exchange and single logout compared to SAML.
C
LDAP
Why wrong: LDAP is a directory protocol, not a federation protocol for SSO.
D
OAuth 2.0
Why wrong: OAuth 2.0 is an authorization framework, not designed for authentication or single logout.

Full breakdown with real-world context →

Question 19easymultiple choice

Read the full Identity and Access Management explanation →

A system administrator notices that user accounts are often left active after employees leave the company. Which process should be automated to address this?

Trap 1: Single sign-on implementation

SSO centralizes authentication but does not automatically deprovision accounts.

Trap 2: Password reset policy

Password reset does not deactivate accounts of former employees.

Trap 3: Multi-factor authentication

MFA strengthens authentication but does not remove inactive accounts.

Study all Identity and Access Management common traps →

A
Single sign-on implementation
Why wrong: SSO centralizes authentication but does not automatically deprovision accounts.
B
Password reset policy
Why wrong: Password reset does not deactivate accounts of former employees.
C
Multi-factor authentication
Why wrong: MFA strengthens authentication but does not remove inactive accounts.
D
Automated account provisioning and deprovisioning
This process ensures accounts are created and disabled in sync with HR records.

Full breakdown with real-world context →

Question 20mediummultiple choice

Read the full Identity and Access Management explanation →

An organization's security policy requires that privileged accounts have their passwords changed every 30 days and be monitored. Which solution effectively manages these requirements?

Trap 1: Role-based access control

RBAC controls permissions but does not manage password lifecycle or monitoring.

Trap 2: Enterprise password manager

A password manager stores passwords but lacks session recording and rotation features.

Trap 3: Single sign-on for administrators

SSO does not enforce password rotation or session monitoring for privileged accounts.

Study all Identity and Access Management common traps →

A
Role-based access control
Why wrong: RBAC controls permissions but does not manage password lifecycle or monitoring.
B
Enterprise password manager
Why wrong: A password manager stores passwords but lacks session recording and rotation features.
C
Privileged Access Management (PAM) solution
PAM provides password rotation, vaulting, session monitoring, and audit trails.
D
Single sign-on for administrators
Why wrong: SSO does not enforce password rotation or session monitoring for privileged accounts.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Identity and Access Management sessions

Start a Identity and Access Management only practice session

Every question in these sessions is drawn from the Identity and Access Management domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Identity and Access Management questions →Mixed CISSP session

Frequently asked questions

What does the CISSP exam test about Identity and Access Management?: Identity and Access Management questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Identity and Access Management questions in a focused session?: Yes — the session launcher on this page draws every question from the Identity and Access Management domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other CISSP topics?: Use the topic links above to move to related areas, or go back to the CISSP question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the CISSP exam covers. They are not copied from any real exam or dump site.

Identity and Access Management only

10 questions 20 questions 30 questions 50 questions

Mixed CISSP session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All CISSP questions Identity and Access Management domain overview CISSP exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Identity and Access Management practice questions

What to know about Identity and Access Management

Common Identity and Access Management exam traps

Identity and Access Management questions

A healthcare organization implements a policy requiring all employees to use biometric fingerprint scanners to access patient records. Which of the following is the MOST significant risk associated with this authentication method?

An organization wants to implement a password policy that balances security and usability. Which of the following is the BEST practice according to current NIST guidelines?

A company uses Role-Based Access Control (RBAC) for its ERP system. A user in the 'Accounts Payable' role needs to temporarily approve purchase orders up to $10,000 while the 'Purchasing Manager' is on leave. What is the BEST way to grant this access?

A company wants to implement multi-factor authentication (MFA) for remote access. Which combination of factors represents something you have and something you are?

An organization uses OAuth 2.0 for delegated access to APIs. A developer creates a public client application that runs on mobile devices. Which OAuth 2.0 grant type is MOST appropriate for this scenario?

Which TWO of the following are valid methods to enforce separation of duties in an access control system?

Which THREE of the following are characteristics of a federated identity management system?

Which TWO of the following are types of access control models?

Refer to the exhibit. A user reports they cannot authenticate to a web application after receiving a new token. The error log shows the above entries. Which of the following is the MOST likely cause?

Exhibit

Exhibit

Drag and drop the steps for implementing a digital signature using asymmetric cryptography in the correct order.

Match each access control type to its description.

A company requires employees to authenticate using a smart card and PIN to access the corporate network. This is an example of which type of authentication?

A security architect is designing access controls for a healthcare application where permissions are based on the user's role, the sensitivity of the data, and the context of the access (e.g., time of day). Which access control model best fits this requirement?

An organization is implementing federated identity to allow partners to access its web application. The solution must support single logout and attribute exchange. Which protocol is most appropriate?

A system administrator notices that user accounts are often left active after employees leave the company. Which process should be automated to address this?

An organization's security policy requires that privileged accounts have their passwords changed every 30 days and be monitored. Which solution effectively manages these requirements?

Track your progress over time

Start a Identity and Access Management only practice session

Related CISSP topic practice pages

Software Development Security practice questions

Security Assessment and Testing practice questions