Doc CC-01Rev 2026-10Class study materialRead ~5 min
Free CISSP practice test: 60 questions across all 8 domains
This is a free practice test for the ISC2 CISSP (Certified Information Systems Security Professional) exam: 60 original scenario questions across all 8 domains of the outline effective April 2024, with a note on every option. Drill one domain, let Weak-spot chase your lowest score, or run Timed 60 against a 72-minute clock.
The console
Weighted like the current outline: nine items from Domain 1, six each from Domains 2 and 8, seven or eight from the rest. Keys 1–4 answer, N moves on.
Item 01 / 60--:--
Drill: answer, read the rationale for all four options, move on. Keys 1–4 pick, N = next.
A new enterprise policy mandates that all sensitive customer data must be protected from unauthorized disclosure at all times. The engineering team submits a design document implementing TLS 1.3 for all internal and external database connections. What critical mapping artifact is missing to fully enforce the policy intent?
Rationale
Pick an answer. The reasoning for every option lands here — including why the wrong ones looked right.
Domain board · correct / seen
- D1–
- D2–
- D3–
- D4–
- D5–
- D6–
- D7–
- D8–
Items
60
Original, written to the April 2024 outline.
Heaviest domain
D1 · 9
Security and Risk Management, 16%.
Timed 60 clock
72:00
The exam’s 3 hours over its 150-item ceiling.
Answer key
15 × A–D
Each letter is the key 15 times. There is no pattern to find.
Three modes, and when each one earns its keep
Step 01
Drill
Start here. Answer, and the rationale pane opens at once with the reasoning for all four options. The domain chips narrow the deck to one area. Use Drill while you are still learning how the exam asks, not only what it asks.
Step 02
Weak-spot
The next item comes from whichever domain has your worst correct-to-seen ratio; untouched domains count as worst, heaviest first. It will stay on one domain longer than is comfortable. That is the feature — a study aid, not the exam’s selection algorithm.
Step 03
Timed 60
All 60 items, a 72:00 countdown, no going back, rationale held until the debrief. It rehearses pacing and the one-way rule of the real exam, not adaptive scoring.
Step 04
Review misses
After any debrief, this replays only the items you got wrong, in Drill. Run it while you still remember why you picked the wrong letter.
How to read the option notes
Every item carries an explanation of the key plus one note per option. The two options you did not touch are dimmed but keep their notes, and those are worth the extra ten seconds.
Read the note on the option you nearly chose. CISSP-style distractors are rarely nonsense; most are true statements aimed at a different question — a detective control where the stem asks what would prevent, a backup schedule where the issue is tolerable data loss, a technical fix where the gap is a missing policy.
Right for the wrong reason
If your reasoning does not match the note, count the item as a miss and write it down. Review misses will not catch it, because the console only knows which letter you clicked.
Think like a manager: where it shows up
37 of the 60 stems carry a qualifier — BEST, MOST, FIRST, LEAST or PRIMARY. The qualifier is where the manager’s view decides the key.
| Signal in the stem | What the key usually does | Tempting distractor |
|---|---|---|
| Someone could get hurt | Protects people first; safety outranks data, uptime and evidence | Saving the system or the evidence |
| BEST or MOST | Serves the business objective broadly: a policy, a process, a risk decision | A precise fix for one system |
| FIRST | Assesses, informs or escalates before changing anything | Jumping straight to remediation |
| Who accepts the risk | Senior management owns the risk; security advises | Security accepting the risk itself |
| An ethics conflict | Applies the ISC2 Code of Ethics canons in order; society before employer | Putting the employer first |
Patterns, not laws — the stem still decides. The governance side is covered in the Domain 1 guide.
What a practice score tells you, and what it doesn’t
The debrief shows a plain tally out of 60 and the same count for each of the 8 domains. It tells you where you already answer in the exam’s style and where you are guessing. That is most of what a practice test is for.
It does not tell you whether you would pass. The real exam is an adaptive test of 100–150 items that picks each question from your previous answers and reports pass or fail against a scaled 700 out of 1000; a fixed deck of 60 cannot reproduce that, and 700 is not a percentage of anything here. The mechanics are on the CISSP exam format page.
The per-domain view also matches the real feedback: a candidate who does not pass receives proficiency levels by domain, not a number.
Signs the deck has done its job
Not a pass prediction — signs the practice has stopped teaching you new things.
- You can say why each wrong option is wrong, not only why the key is right.
- After a full Weak-spot pass, no domain sits far below the others.
- Timed 60 finishes inside 72:00 and the last ten items get the attention the first ten did.
- Domain 3 feels routine too; the architecture and engineering guide has a 12-item drill for models and cryptography.
Questions people ask
Q01What type of questions are on the CISSP exam?
Mostly four-option multiple-choice scenarios, plus advanced innovative items such as drag-and-drop or hotspot; ISC2 does not publish the exact mix. Many ask for the BEST, FIRST or MOST appropriate action, so judgment matters more than recall.
Q02What is the best practice exam for the CISSP certification?
One that is current and explains itself: written to the outline effective April 2024, with reasoning for every option, not only the key. If a mock describes anything other than an adaptive exam of 100–150 items in 3 hours, it predates that outline. Skip anything claiming real exam questions; exam content is confidential under the ISC2 non-disclosure agreement.
Q03Does a good score on this practice test mean I will pass?
No. Sixty fixed items score right or wrong; the exam is adaptive, scores you against a 700/1000 scaled standard and reports pass or fail, with domain proficiency levels on a failing report. Use the score by domain instead: a domain that stays behind across Drill, Weak-spot and Timed 60 is where the next week of study goes. The CISSP study plan covers how to split the weeks.
Q04Are these practice questions harder than the real CISSP exam?
Not by design. They copy the format — several defensible options, a qualifier that decides the key, and no going back in Timed 60 — but not the adaptive engine, which keeps serving items near the edge of what you can do, so the exam can feel harder even when it is going well. ISC2 does not publish pass rates; treat any quoted figure as a guess.
Debrief · key takeaways
- Drill to learn the style, Weak-spot to level the board, Timed 60 for pacing.
- Read the note on the option you nearly picked.
- Answer from the manager’s seat: people, then business and risk ownership, then technology.
- A practice tally predicts nothing about a pass; the domain board is what to act on — the CISSP study guide maps all eight.
Field kit
Sixty items run out. The app’s bank does not.
The CISSP prep app carries a far larger bank of original practice items, on iPhone and Android.