CISA Practice Test

CISA practice test: what's covered

• Manufacturer Accountability
• Secure Defaults
• Procurement Evidence
• Vulnerability Transparency

Free CISA sample questions

1. A SaaS manufacturer says security is a customer configuration task and ships the product with optional MFA, optional audit logging, and paid SSO. You are reviewing it against Secure by Design expectations. What is the strongest finding?

   • A. The product can still be acceptable if the vendor documents every optional security add-on in a public FAQ.
   • B. The manufacturer is not treating customer security as a core business requirement because key protections are not secure by default or included without added cost.
   • C. The main issue is branding because Secure by Design is only a marketing pledge and has no technical meaning for product teams.
   • D. The product should be approved if customers can enable MFA manually after the initial procurement is complete.
   Show answer

   Correct: B. CISA frames Secure by Design as a shift of responsibility toward manufacturers, with out-of-the-box protections such as MFA, logging, and SSO available without added cost. A FAQ or manual opt-in does not correct the core weakness because the insecure burden remains on each customer.

2. A product leader asks what evidence would show real progress on Secure by Design rather than a policy statement. Which two artifacts are strongest?

   • A. A public roadmap showing how the manufacturer will reduce a named vulnerability class across product lines.
   • B. A sales deck stating that customers can buy a premium security package after onboarding.
   • C. A measured report showing MFA adoption or default-enablement progress across customer tenants.
   • D. A private assurance that future releases may include security features if customers request them.
   Show answer

   Correct: A and C. CISA emphasizes measurable progress and transparency. Roadmaps and adoption/default-enablement metrics show action at product scale. A premium package or private assurance is weaker because it does not prove that safer outcomes are becoming the default for customers.

3. An engineering manager wants to reduce SQL injection findings across five web products. What approach best matches CISA's class-of-vulnerability reduction idea?

   • A. Ask developers to be more careful in code reviews while keeping each team free to build database queries manually.
   • B. Create a standard data-access layer that enforces parameterized queries and block raw string-concatenated SQL in CI.
   • C. Wait for external penetration tests because SQL injection is easier to detect after release than during design.
   • D. Publish a customer hardening guide that explains how customers can detect SQL injection attempts in their SIEM.
   Show answer

   Correct: B. The strongest answer removes the vulnerable pattern at scale by making safer implementation the paved road. Reviews and customer monitoring help but do not eliminate the class. Waiting for external tests preserves the same design defect until late in the lifecycle.

4. A security architect is asked why a short-term increase in reported CVEs is not automatically a failure of Secure by Design work. What answer is most defensible?

   • A. More CVEs always means the product became less secure and the manufacturer should stop publishing them.
   • B. More complete reporting can temporarily increase CVE counts while root-cause work reduces the targeted vulnerability class over time.
   • C. CVEs are only useful for open source software and should not be considered for enterprise SaaS products.
   • D. The manufacturer should replace CVEs with private customer emails so competitors cannot compare public records.
   Show answer

   Correct: B. CISA cautions against treating CVE volume alone as a negative signal. Transparent reporting can rise while the manufacturer improves discovery and disclosure. The important evidence is whether the underlying vulnerability class decreases over time and whether customers receive actionable records.

5. A vendor is planning a memory-safety roadmap for a legacy product written partly in C and C++. Which two actions best align with practical Secure by Design progress?

   • A. Prioritize high-risk components and new development for memory-safe languages or safer libraries where feasible.
   • B. Publish a roadmap that also covers risky external dependencies and migration constraints.
   • C. Announce that memory safety is solved because the product passed one vulnerability scan.
   • D. Hide the roadmap until every component is rewritten so customers cannot see interim risk.
   Show answer

   Correct: A and B. CISA's memory-safety guidance encourages roadmaps, prioritization, and transparency, including external dependencies. A single scan does not remove a vulnerability class, and hiding the plan prevents customers from understanding risk reduction and sequencing.

Last updated: 2026-10-19

CISA practice test FAQ