CISSP Resources · Study strategy
Thinking Like a Manager: How to Answer CISSP Scenario Questions
Most CISSP questions are short scenarios with four answers that all sound reasonable. The exam is not asking which answer is true — it is asking which one a security manager would choose. This guide breaks down the keywords, the elimination process, and four worked examples.
Think like a manager, not a technician
A security manager's job is to protect the organisation's goals within its risk appetite. That means people safety comes first, decisions follow policy and senior management direction, and process comes before tools. When a technical answer and a governance answer both work, the exam usually wants the one that addresses the root cause at the right level.
- Human safety beats every other consideration.
- Senior management owns risk; security advises.
- Understand before acting — assess, classify, or investigate before you fix.
- Policy and process before a specific product or configuration.
The keywords that change the answer
| Keyword | What it asks for |
|---|---|
| FIRST | The earliest correct step in a process — often assess, identify, or notify |
| BEST | The option that solves the whole problem, not part of it |
| MOST | The strongest or most important option among several valid ones |
| PRIMARY | The main purpose or goal, not a side benefit |
| LEAST | Reverse the logic — find the weakest or least appropriate option |
Underline the keyword and who you are in the scenario (manager, auditor, consultant). Both change which answer is correct.
A four-step elimination method
- Identify the actual problem the scenario describes, in your own words.
- Remove answers that are false or outside your role.
- Remove answers that treat a symptom instead of the problem.
- Of what is left, pick the one at the highest appropriate level — often the governance or process answer.
Four worked examples
1. Fire alarm during an incident
You are containing a malware outbreak when the building fire alarm sounds. What should you do FIRST? The answer is to evacuate. Preserving evidence or isolating systems matters, but human safety always comes first.
2. A new regulation applies
A new privacy law affects your organisation. What is the BEST first step? Assess its impact on the business and inform senior management — not buying a tool or rewriting firewall rules.
3. Repeated phishing success
Staff keep falling for phishing emails. The MOST effective long-term control is ongoing security awareness training backed by policy. A better email filter helps, but it addresses the symptom, not the behaviour.
4. Who accepts the risk?
A business unit wants to skip a control to meet a deadline. Who should accept the residual risk? The asset or business owner at an appropriate management level — never the security team on the business's behalf.
Drill each domain on its own with the CISSP practice questions by domain.
Frequently asked questions
Why are several CISSP answers technically correct?
The exam tests judgement. Several options may work, but only one is the best fit for a manager's role, the keyword in the question, and the root cause of the problem.
Is the answer always the management option?
No, but it is often the answer when a technical and a governance option both address the problem. Always check the keyword and your role in the scenario first.
Practise scenario questions with full explanations
Every Domain Eight question includes a decision rationale explaining why the best answer beats the others — the exact skill scenario questions test.
Related guides
- CISSP CAT Exam ExplainedHow adaptive questions behave, why exams end early, and how to rehearse the format.
- CISSP Study Plan for Busy ProfessionalsA week-by-week plan built around a full-time job.
- Why People Fail the CISSPThe predictable traps that cause retakes, and what to do instead.
- Domain 1: Security and Risk ManagementGovernance, risk treatment, law and ethics — the domain that teaches you to think like a manager.
More CISSP study material from Domain Eight: browse all resources.