Security and Risk Management makes up 16% of your total CISSP score. Many candidates mistakenly treat this domain as a simple vocabulary test of frameworks and policies, only to be blindsided by questions that demand nuanced, risk-based judgment under pressure. The exam doesn't want to know if you can define "risk appetite"; it wants to know if you can apply it to a business decision when a million-dollar project is on the line.
These free CISSP practice questions for Domain 1 (Security and Risk Management) are designed by certified experts to mirror the 2026 exam's focus on judgment and application. Use them to diagnose your weaknesses in risk analysis, governance, and compliance before you walk into the testing center.
Key facts
- Official Body: (ISC)²
- Domain 1 Weighting: 16% of the total exam score.
- Passing Score: 700 on a 1000-point scale.
- Exam Format: Computerized Adaptive Testing (CAT) for the English exam.
- Number of Questions: 125-175 questions.
- Exam Duration: 4 hours.
According to the official (ISC)² CISSP Exam Outline, Security and Risk Management is the second most heavily weighted domain, making it a critical area for mastery (ISC²).
About These Free Security and Risk Management Questions
These are not your average brain-dump questions. I’ve written this set of 10 questions to reflect the real CISSP exam's style and difficulty, focusing specifically on Domain 1: Security and Risk Management. They are fully aligned with the current (ISC)² exam blueprint that will be in effect for the 2026 testing year.
Studying for CISSP? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
The questions are a mix of difficulties. Some test foundational knowledge, while others require you to analyze a scenario and make a judgment call, just like the real exam.
For each question, I provide a detailed rationale that explains not only why the correct answer is right but, more importantly, why the incorrect answers (the "distractors") are wrong. Pay close attention to these explanations. They are designed to teach you the mindset required to pass. If you feel stuck, this is a great time to try VoraPrep's free CISSP practice questions with our Vory tutor to guide you.
Security and Risk Management Practice Questions
Answer the following 10 questions. Track your answers on a piece of paper, and then review the detailed explanations below. No guessing. If you don't know, mark it and move on.
Question 1
A retail company processes 10,000 credit card transactions per day. A recently discovered vulnerability in their point-of-sale (POS) system could lead to a data breach. The security team estimates that if the vulnerability is exploited, the cost of forensic investigation, fines, and customer notification would be $500,000 per incident. Historical data from similar vulnerabilities suggests such an event is likely to occur once every five years. The cost to implement a compensating control is $120,000 per year. From a purely financial perspective, what is the most appropriate risk response?
Question 2
A hospital is developing a new policy for handling electronic protected health information (ePHI). Which of the following would provide the MOST specific and mandatory instructions for nurses on how to encrypt patient data on a mobile device?
Question 3
A Chief Information Security Officer (CISO) is presenting a risk assessment to the board of directors. The CISO wants to communicate the impact of potential security incidents in a way that is easily understood by non-technical executives and can be used for budget prioritization. Which risk analysis method is most suitable for this purpose?
Question 4
An organization has a policy stating that all employees must maintain a clean desk and lock their computer screens when leaving their workstations. An auditor observes that several employees in the finance department have sensitive documents on their desks and their computers are unlocked. This is a failure of which of the following?
Question 5
Which of the following BEST defines the concept of risk appetite?
Question 6
A software development company wants to integrate security into the earliest stages of its System Development Life Cycle (SDLC). Which of the following methodologies would be most effective for identifying potential security flaws in the design phase?
Question 7
A company is headquartered in Germany and has a data processing center in the United States. The company collects personal data from customers who are citizens of France. Which data privacy regulation would have primary jurisdiction over the handling of the French customers' data?
Question 8
During a Business Impact Analysis (BIA), the team determines that the Maximum Tolerable Downtime (MTD) for a critical billing system is 8 hours. The time required to restore the system from backups is estimated to be 6 hours. What is the Recovery Time Objective (RTO) for this system?
Question 9
An organization classifies its data into Public, Internal, Confidential, and Restricted categories. A document containing employee salary information should be classified as which of the following?
Question 10
According to the (ISC)² Code of Ethics, which canon has the highest priority?
Answers and Explanations
Question 1: Answer and Explanation
The correct answer is D) Accept the risk as the cost of the control is too high.This question is a classic quantitative risk analysis problem disguised as a scenario. You must calculate the Annualized Loss Expectancy (ALE) and compare it to the cost of the control.
Step 1: Calculate the Single Loss Expectancy (SLE).
The SLE is the financial loss from a single event. The problem states this is $500,000. SLE = $500,000Step 2: Calculate the Annualized Rate of Occurrence (ARO).
The ARO is how often the event is expected to happen per year. The problem states it occurs once every five years. ARO = 1 ÷ 5 = 0.2Step 3: Calculate the Annualized Loss Expectancy (ALE).
The ALE is the total expected loss per year. ALE = SLE × ARO ALE = $500,000 × 0.2 = $100,000Step 4: Compare ALE to the Control Cost.
The annualized cost of the control is $120,000. The expected annual loss (ALE) is $100,000. Decision: Since the cost to implement the control ($120,000) is greater than the expected annual loss ($100,000), a purely financial decision would be to accept the risk. Implementing the control would cost more than the loss you are trying to prevent.- Why A is wrong: Mitigating the risk is tempting because it feels like the "secure" thing to do. However, the CISSP exam requires you to think like a business advisor. Spending $120,000 to prevent a $100,000 loss is a poor business decision.
- Why B is wrong: Transferring risk is a valid response, but the question asks for the most appropriate response based on the financial data provided. We don't have enough information about insurance premiums to evaluate this option against the others.
- Why C is wrong: Avoiding the risk by stopping credit card transactions would likely have a massive, unstated business cost that far exceeds the ALE. This is an extreme measure and not the best first choice.
Question 2: Answer and Explanation
The correct answer is D) Procedure.This question tests your understanding of the governance hierarchy. You must know the function of each document type.
- A Policy is a high-level statement of intent from senior management (e.g., "We must protect all patient data."). It is mandatory but not detailed.
- A Standard provides mandatory requirements to support a policy (e.g., "All mobile devices must use AES-256 encryption.").
- A Guideline is a recommended, non-mandatory best practice (e.g., "It is recommended to use a complex passphrase of at least 12 characters.").
- A Procedure is a detailed, step-by-step set of instructions to perform a specific task (e.g., "Step 1: Open the settings menu. Step 2: Tap 'Security'. Step 3: Enable full-disk encryption...").
The question asks for the most specific and mandatory instructions, which perfectly describes a procedure.
Question 3: Answer and Explanation
The correct answer is B) Qualitative analysis.The key here is the audience: non-technical executives.
- Qualitative analysis uses descriptive terms like "High," "Medium," and "Low" or a color scale (red, yellow, green) to describe risk. This is ideal for communicating with leadership because it's intuitive and focuses on prioritization without getting bogged down in complex calculations.
- Quantitative analysis (A) is tempting because it seems more precise, using dollar figures (like the ALE calculation in Question 1). However, it relies on many assumptions, and the complexity can obscure the message for a non-technical board. It's better for comparing specific control costs, not for a high-level overview.
- Threat modeling (C) and vulnerability scanning (D) are technical activities that provide input into a risk analysis, but they are not the methods used to communicate the final results to the board.
Question 4: Answer and Explanation
The correct answer is B) Due care.This is a critical distinction for the exam.
- Due care is the action of behaving as a reasonable and prudent person would under similar circumstances. Having a clean desk policy and then following it is exercising due care. The employees failed to take this reasonable action to protect company assets.
- Due diligence is the investigative and preparatory step before an action. It's the research and analysis to ensure you are making informed decisions. For example, performing a background check on a new cloud provider is due diligence. The company did perform due diligence by creating the policy in the first place. The failure was in the execution (due care).
Think of it this way: Due diligence is doing your homework. Due care is not falling asleep during the test.
Question 5: Answer and Explanation
The correct answer is B) The total amount of risk an organization is willing to seek or accept to achieve its objectives.This is a definition question, but the distractors represent other key risk concepts.
- Risk appetite (B) is a broad, strategic statement about the level of risk the organization is willing to take on as a whole to pursue its goals.
- Risk tolerance (related to A) is the specific, tactical deviation from the risk appetite that is acceptable for a particular system or project. Option A more closely describes an accepted level of residual risk, which is an outcome of risk tolerance.
- Risk mitigation (C) is a risk response strategy, not the definition of risk appetite.
- A security policy (D) is a document that is informed by the organization's risk appetite, but it is not the appetite itself.
Question 6: Answer and Explanation
The correct answer is C) Threat modeling.The key phrase is "earliest stages" and "design phase."
- Threat modeling is a systematic process of identifying potential threats and vulnerabilities from an attacker's perspective during the design phase, before any code is written. Methodologies like STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) are used here.
- Penetration testing (A), DAST (B), and code review (D) are all performed after code has been written. They are valuable, but they occur later in the SDLC. The question specifically asks for the earliest, design-phase activity.
Question 7: Answer and Explanation
The correct answer is C) The EU General Data Protection Regulation (GDPR).This question tests your understanding of data privacy regulations and their extraterritorial scope.
- GDPR applies to the processing of personal data of individuals residing in the EU, regardless of where the company is located or where the data is processed. Since the customers are French citizens (residing in the EU), GDPR is the primary regulation. The company's headquarters in Germany and processing center in the US do not change this.
- The U.S. CLOUD Act (A) deals with law enforcement access to data stored by U.S. companies, which is a different issue.
- Germany's BDSG (B) implements and supplements GDPR within Germany but GDPR is the overarching regulation concerning the data of an EU citizen (the French customer).
- CCPA (D) applies to residents of California.
Question 8: Answer and Explanation
The correct answer is B) Must be less than or equal to 8 hours.This question tests your understanding of business continuity terms.
- Maximum Tolerable Downtime (MTD) is the absolute longest a business function can be unavailable before the organization suffers irreparable harm. It is the business driver.
- Recovery Time Objective (RTO) is the target time within which a business process must be restored after a disaster to avoid unacceptable consequences.
The RTO is a technical objective that must be set to meet the business's MTD. Therefore, the RTO must always be less than or equal to the MTD. Since the MTD is 8 hours, the RTO must be 8 hours or less. The 6-hour restoration time confirms that an RTO of ≤ 8 hours is achievable.
Question 9: Answer and Explanation
The correct answer is C) Confidential.While data classification schemes can vary between organizations, the CISSP exam uses a common model. You must choose the BEST fit.
- Public: No harm if disclosed.
- Internal: For internal use only. Minor harm if disclosed. (e.g., internal memos, phone lists).
- Confidential: Requires specific authorization to access. Significant harm if disclosed. (e.g., salary data, M&A plans, PII).
- Restricted: Most sensitive data. Grave harm if disclosed. (e.g., trade secrets, state secrets, system passwords).
Employee salary information is highly sensitive and its unauthorized disclosure would cause significant harm to employees and the organization. This fits the Confidential level. Some might argue for "Internal," but that's the tempting distractor. Standard employee lists are internal; salary data requires a higher level of protection.
Question 10: Answer and Explanation
The correct answer is D) Protect society, the common good, necessary public trust and confidence, and the infrastructure.The (ISC)² Code of Ethics canons are presented in order of priority. This is a pure memorization question, but one that frequently appears.
The order is:
- Protect society, the common good, necessary public trust and confidence, and the infrastructure.
- Act honorably, honestly, justly, responsibly, and legally.
- Provide diligent and competent service to principals.
- Advance and protect the profession.
You can remember the order with the mnemonic "Protect Society, Act Honorably, Provide Service, Advance Profession" or PAPA. The first canon, protecting society, always comes first.
Calculate Your CISSP Score & Study Hours by Domain
Adjust your practice scores across official CISSP blueprint domains to predict your pass probability and generate a domain-weighted study schedule.
How Did You Score?
Count up your correct answers. Your score here isn't a prediction, it's a diagnosis. It tells you where to focus your energy.
- 8-10 Correct: You have a strong command of the core concepts in Domain 1. Your task is to refine that knowledge. You likely understand the definitions but might have hesitated on the scenario-based questions. Your next step should be to work on speed and recognizing the subtle clues in question stems. Drill down on the topics you missed, even if it was just one question. For more advanced practice, check out the Best CISSP Review Courses (2026) to see how VoraPrep's adaptive engine compares.
- 5-7 Correct: You are in the most common, and most dangerous, position. You know the vocabulary, but you struggle to apply it under pressure. You probably missed the ALE calculation, confused due care and due diligence, or got caught on the governance hierarchy. This signals a gap between memorization and judgment. Your next step is critical: do not just read more. You must actively work through hundreds of practice questions with detailed explanations. This is exactly what VoraPrep's adaptive question bank is built for.
- 0-4 Correct: You have significant foundational gaps in this domain. This is not a cause for panic, but it is a call to action. Trying to pass the exam from this position without a structured plan is a recipe for failure. Your next step is to go back to the beginning of Domain 1. Use a comprehensive study guide, like the textbook-grade lessons included in VoraPrep, to rebuild your understanding from the ground up before attempting more questions. If you've failed before, read our guide on CISSP Exam Retake Strategy (2026).
Get More CISSP Practice on VoraPrep
This small sample is just the beginning. To truly prepare for the adaptive nature of the CISSP exam, you need a larger, more dynamic toolset.
The VoraPrep CISSP course includes a complete suite of six study pillars designed for busy professionals. Our platform features:
- Over 2,200 adaptive practice questions that are calibrated to the real exam's difficulty. Our engine learns your weak areas and serves you more questions on topics like risk analysis or legal systems until you master them.
- Detailed, expert-written rationales for every single question. We explain why the right answer is right and why each distractor is wrong, teaching you the critical thinking skills the exam demands.
- Vory, your 24/7 personal tutor. If you're stuck on a concept, you can ask Vory for a step-by-step explanation right inside the platform, any time of day or night.
- A full 6-pillar learning system that goes far beyond a simple question bank. You get textbook-grade lessons, spaced-repetition flashcards, a personalized study planner, and full-length exam simulators, all included.
Legacy courses charge thousands for outdated video lectures. VoraPrep provides a complete, interactive learning system for a simple monthly or annual subscription. You can see a full breakdown on our official VoraPrep page.