Sample Questions from Certified Information Systems Security Professional (CISSP)

Preview a few questions below — answers are revealed when you take the exam.

1. A multinational corporation is implementing a new cloud-based data storage solution. The security team is concerned about data sovereignty and compliance with international data protection laws. What strategy should be applied to ensure that the solution complies with all relevant regulations while maintaining data security and integrity?

   • Implement a multi-cloud strategy with data encryption and regular compliance audits to ensure adherence to international data protection laws.
   • Use a single cloud provider with the most robust data security features and rely on their compliance certifications for all regions.
   • Store all data in a single geographic location to simplify compliance and use virtual private networks (VPNs) for secure access.
   • Adopt a hybrid cloud approach with on-premises data storage for sensitive information and cloud storage for non-sensitive data.

2. Identify the command used in Linux to display the current user's environment variables.

   • printenv
   • env
   • echo $ENV
   • showenv

3. Consider a scenario where an organization experiences a significant data breach. The incident response team is tasked with conducting a thorough post-mortem analysis to identify the root cause and prevent future incidents. Which method solves it best for evaluating the effectiveness of the incident response plan and identifying areas for improvement?

   • Conduct a comprehensive after-action review involving all stakeholders, analyze the incident timeline, and identify gaps in the incident response plan.
   • Rely solely on external forensic experts to conduct the post-mortem analysis and provide recommendations for improvement.
   • Focus the post-mortem analysis on technical aspects of the breach and ignore human factors and procedural weaknesses.
   • Implement a new incident response plan without analyzing the effectiveness of the previous plan.

4. What service is responsible for managing and orchestrating containers in a Kubernetes cluster?

   • kube-proxy
   • kube-scheduler
   • kube-controller-manager
   • kube-apiserver

5. A financial services company is planning to adopt a zero-trust security model. The security team needs to design a strategy that ensures secure access to critical applications and data while minimizing the attack surface. What configuration is most appropriate for implementing zero-trust principles in the company's network architecture?

   • Implement micro-segmentation, continuous authentication, and least privilege access controls to enforce zero-trust principles.
   • Rely on traditional perimeter-based security measures and assume trust for internal network traffic.
   • Use a single sign-on (SSO) solution for all applications and grant broad access permissions to users.
   • Deploy a next-generation firewall (NGFW) at the network perimeter and assume trust for internal traffic.