CISSP Domain 1 practice questions
Security and Risk Management
Domain 1 is the heaviest-weighted domain and sets the tone for the whole exam. It tests whether you think like a security leader: governance before tooling, risk decisions owned by the business, and due care backed by policy. Expect scenarios where several answers are technically correct but only one reflects what senior management should do first.
Sample Domain 1 questions
A business unit wants to launch a product that introduces a risk above the organisation's stated appetite. The CISO has documented the risk and proposed controls the unit has declined. What should happen NEXT?
An asset worth $200,000 has a 25% exposure factor to flooding, expected once every 10 years. What is the annualised loss expectancy?
Which document is MOST appropriate for communicating mandatory, organisation-wide requirements set by senior management?
Common Domain 1 traps
- Picking a technical control when the question is really about governance or accountability.
- Confusing due care (doing the right thing) with due diligence (verifying it is being done).
- Assuming the security team accepts risk — risk acceptance belongs to the asset or business owner.
Key concepts to master
- Risk analysis: ALE = SLE × ARO, qualitative vs quantitative
- Risk responses: mitigate, transfer, avoid, accept
- Policy, standard, procedure and guideline hierarchy
- BCP / BIA: MTD, RTO, RPO
- Legal and regulatory: privacy, intellectual property, ISC2 Code of Ethics
Need the theory first? Read the CISSP Domain 1 study guide.
Find out where you stand
Start with the free 10-question CISSP practice test — no signup. Then create a free account for Practice Mode, or go Pro for Domain Quick-Fire, CAT-style adaptive exams and readiness analytics.