(ISC)2 CISSP - Certified Information Systems Security Professional - Security Risk Architecture Networking IAM Operations Software

By Sam Patel · Updated Jul 10, 2026

Questions25
Passing Score75%
Format100% Multiple Choice
Sessions Logged1,867
Your progressLog in / Register to track times taken, best score, questions mastered, and coverage on this quiz.
Rating
4.6 (24)

Topics covered

This quiz

Uncategorized25 (100%)

Uncategorized25 questions

Browse more · Report this quiz

Question catalog for this preview

Catalog listing of the 5 preview questions for this quiz.

Question 1

A cloud architect is designing a multi-cloud data residency strategy for an organization that must comply with GDPR (EU data) and data localization laws in multiple countries. Which architectural approach BEST addresses these requirements?

Answer choices

  • A. Store all data in a single US-based data center for simplicity

  • B. Implement data residency controls using cloud regions/zones aligned with regulatory requirements, with data sovereignty policies ensuring personal data of EU citizens is processed and stored within the EU, and national data is processed within respective countries

  • C. Encrypt all data — encrypted data is exempt from data residency requirements

  • D. Use a content delivery network (CDN) — CDNs are exempt from data localization laws

Question 2

A cloud-based application processes healthcare data (PHI) and must comply with HIPAA. The application uses AWS as its infrastructure provider. Regarding shared responsibility for HIPAA compliance, which statement is CORRECT?

Answer choices

  • A. AWS is fully responsible for HIPAA compliance since they are the "covered entity" providing the service

  • B. HIPAA compliance is shared: AWS is responsible for the security OF the cloud (physical infrastructure, hypervisor, managed services), while the organization is responsible for security IN the cloud (application security, access control, encryption key management, PHI handling, BAA terms)

  • C. The organization is fully responsible for all HIPAA compliance including AWS's physical security

  • D. HIPAA doesn't apply to cloud-hosted PHI — only on-premise systems require HIPAA compliance

Question 3

A security team is planning a penetration test of a production web application. The organization wants to understand real-world attack risk while minimizing disruption to live users. Which test type is most appropriate?

Answer choices

  • A. White box testing — provide full application documentation and source code to pentesters

  • B. Black box testing — pentesters have zero knowledge, simulating an external attacker

  • C. Gray box testing — provide limited information (user credentials, general architecture) simulating a partially-informed attacker (e.g., insider threat, credential-obtained attacker)

  • D. Red team engagement — multi-week adversarial simulation of advanced persistent threats

Question 4

A vulnerability assessment reveals that a critical production server hasn't been patched in 18 months. The system owner argues that patching requires an outage that the business cannot afford. What risk management approach and security principle applies?

Answer choices

  • A. Accept the risk permanently since the business need overrides security requirements

  • B. Apply the risk management framework: document the risk exception with specific acceptance criteria, require compensating controls (additional monitoring, network isolation, WAF), set a review date, and require sign-off by appropriate risk acceptance authority — all exceptions have business owners accountable for accepted risk

  • C. Bypass the change management process and patch during business hours to minimize downtime

  • D. Immediately take the system offline since it represents an unacceptable risk

Question 5

During a forensic investigation, a security analyst needs to analyze a suspect hard drive image. Which principle is MOST critical to maintain forensic integrity?

Answer choices

  • A. Analyze the original drive directly to avoid any data transformation

  • B. Create a forensic copy (bit-level image) of the original drive, verify hash values (SHA-256/MD5) of original and copy match, and analyze ONLY the copy — this preserves evidence integrity and maintains chain of custody

  • C. Analyze the drive in the original system to preserve the original execution environment

  • D. Document findings first, then create a forensic image