CISSP Practice Test

CISSP practice test: what's covered

Free CISSP sample questions

1. During a corporate forensic investigation into an insider data exfiltration incident, a forensic analyst must preserve digital evidence collected from the suspect workstation. What is the PRIMARY purpose of maintaining a strict chain of custody throughout this process?

   • A. Ensure evidence is admissible in court by documenting handling, transfer, and storage
   • B. Reduce cloud storage and backup costs for enterprise forensic disk images
   • C. Allow remote IT helpdesk technicians direct access to evidence files
   • D. Automate the generation of incident response executive summary reports
   Show answer

   Correct: A. In an enterprise forensic investigation, maintaining a strict chain of custody is essential to establish evidence admissibility in court by accounting for every individual who handled, transferred, or stored the physical and digital artifacts. Without documented custody, evidence can be challenged as tampered or unreliable. Options B, C, and D are incorrect because chain of custody does not serve to reduce storage overhead, grant helpdesk access, or generate executive reports.

2. A corporate legal team is evaluating potential legal actions following an employee's theft of enterprise trade secrets. The lead investigator must advise executive leadership on which legal proceeding imposes the HIGHEST burden of proof.

   • A. Criminal prosecution conducted by government law enforcement authorities
   • B. Civil litigation filed in corporate enterprise claims court
   • C. Administrative internal employee disciplinary proceeding
   • D. Regulatory compliance audit conducted by external industry overseers
   Show answer

   Correct: A. In legal investigations, criminal proceedings carry the highest burden of proof, requiring guilt to be proven 'beyond a reasonable doubt'. Civil litigation requires a 'preponderance of evidence' (more likely than not), while administrative and regulatory reviews use lower thresholds. Options B, C, and D carry lower burdens of proof than criminal prosecution.

3. During a digital forensics investigation of a compromised server endpoint, the lead analyst applies Locard's Exchange Principle to guide artifact collection. How does this forensic principle apply to digital security operations?

   • A. Encryption keys can always be recovered using brute-force mathematical analysis
   • B. Every interaction between an attacker and a computer system leaves digital traces on both
   • C. Digital forensic tools must exclusively be open-source and community-vetted
   • D. Evidence files must be hashed twice using different cryptographic algorithms
   Show answer

   Correct: B. Locard's Exchange Principle is a fundamental forensic concept stating that whenever two entities interact, a transfer of material occurs. In digital forensics, an attacker interacting with a host or network inevitably leaves artifacts (logs, registry changes, memory artifacts, MAC times) while receiving data. Options A, C, and D misstate forensic concepts regarding key recovery, tool licensing, and hashing mandates.

4. Prior to acquiring a forensic image of a hard drive recovered from a suspect system, which critical operational procedure must the investigator perform FIRST to maintain evidence integrity?

   • A. Reformat the destination drive before attaching the source storage
   • B. Connect a hardware write blocker and compute cryptographic hashes of the source before and after acquisition
   • C. Perform a hard power-cycle on the target machine to clear volatile memory
   • D. Apply full-disk encryption to the suspect drive to prevent unauthorized viewing
   Show answer

   Correct: B. Before imaging digital media, a forensic investigator must attach a physical or software write blocker to prevent any OS writes to the source drive, and generate cryptographic hashes (SHA-256/MD5) before and after imaging to prove bit-for-bit integrity. Formatting destination drives, power-cycling, or encrypting source drives either destroy evidence or alter source timestamps.

5. While responding to an active physical security alert in an enterprise data center, a SecOps analyst discovers an unlabelled USB flash drive inserted into a critical database server. What is the analyst's FIRST action?

   • A. Remove the USB drive and plug it into a triage workstation to inspect its contents
   • B. Document its physical location, photograph it in place, and safely package it as evidence with a chain-of-custody log
   • C. Take the USB flash drive home for off-site analysis away from corporate network monitoring
   • D. Execute a quick format command on the drive immediately to eliminate potential malware payloads
   Show answer

   Correct: B. When physical evidence such as an unauthorized USB drive is discovered, the analyst must preserve the scene by documenting the exact physical context, photographing it in place, and securing it in anti-static evidence packaging with chain-of-custody documentation. Plugging it into any machine risks malware execution or evidence alteration; taking it off-site breaks custody; formatting it destroys vital forensic evidence.

Last updated: 2026-10-19

CISSP practice test FAQ

Related practice tests

• CISSP practice test
• ISC2 CC practice test
• ISC2 CCSP practice test
• ISC2 CGRC practice test
• ISC2 SSCP practice test