Every CISSP practice question has a stem keyword that signals which reasoning framework to use. Most candidates ignore this signal entirely. Here are 15 free CISSP practice questions — 3 per question type — with a stem-decoding walkthrough that teaches you the meta-skill behind every correct answer.
There is a skill that does not appear on any CISSP study resource list. It is not a domain. It is not a framework. It is the ability to read a question stem before you evaluate a single answer choice — and use the wording of that stem to immediately know which decision framework the question is testing.
The (ISC)² exam committee does not write questions randomly. Every use of the word FIRST, BEST, MOST, NOT, or EXCEPT in the stem is a deliberate signal. Each signal changes what constitutes a correct answer. Candidates who miss this signal answer a different question than the one being asked — and they do it confidently, which makes the error hard to diagnose from score reports.
This guide gives you 15 free CISSP practice questions organized by question type, not by domain. The explanations focus on stem-decoding: what the keyword tells you before you read the first answer choice, and why that changes your analysis. If you want domain-specific practice, our 10 worked domain examples cover all 8 domains. This article teaches you to read any question correctly once you get there.
The One Habit That Changes Everything
Before you read a single answer choice, underline or mentally mark the stem keyword (FIRST, BEST, MOST, NEXT, EXCEPT, NOT). This forces your brain to load the correct reasoning framework before any answer choice can anchor you to the wrong one. Candidates who build this habit consistently report that CISSP questions feel far less ambiguous within weeks.
Why Question Stems Are More Important Than the Answers
The CISSP is specifically designed to distinguish between candidates who know the right answer and candidates who know how to think about security decisions. Most questions present four options that are all technically accurate in some context. The stem keyword is what defines which context applies — and therefore which answer is correct.
This is not a subtle distinction. It is structural. A question asking what you should do FIRST may have a correct answer that is different from the same scenario asking what you should do NEXT or what is the BEST course of action. Because the reasoning constraint changes, the answer changes — even when the domain knowledge required is identical.
The CISSP CAT exam escalates difficulty as you demonstrate competence. At higher difficulty levels, the stem structures become more complex: layered scenarios with embedded sequencing questions, BEST-answer frames inside a multi-constraint scenario. Candidates who have not trained on stem-reading struggle disproportionately at these difficulty levels — not because they lack knowledge, but because they are applying the wrong reasoning framework.
The 5 CISSP Question Types at a Glance
| Type |
Stem Keywords |
What It Tests |
Primary Reasoning Trap |
| Sequencing |
FIRST, NEXT, THEN, BEFORE |
Correct order of operations in a defined procedure |
Selecting the most important action, not the first |
| Judgment |
BEST, MOST APPROPRIATE |
Optimal decision given competing valid options |
Selecting the technically correct answer instead of the managerially correct one |
| Comparative |
MOST EFFECTIVE, MOST LIKELY, GREATEST |
Relative ranking of controls or attack vectors |
Selecting a correct answer instead of the most correct answer |
| Elimination |
EXCEPT, NOT, LEAST |
Identifying the outlier among correct-adjacent options |
Failing to register the inversion and selecting a true statement |
| Scenario |
A long setup paragraph with multiple constraints |
Applying judgment within a specific defined context |
Answering the general question instead of the scenario-specific one |
⚠️ The Anchoring Problem
When you read answer choices before identifying the stem type, the first plausible option you encounter becomes a cognitive anchor. Every subsequent option gets evaluated against it rather than against the question’s actual constraint. This is especially dangerous in EXCEPT questions, where the anchoring option is likely correct — which locks you into the wrong reasoning mode entirely.
1️⃣
Question Type 1
FIRST / NEXT — Sequencing Questions
The stem demands the correct order of operations. The best action overall is often not the first action. Identify the logical prerequisite before any other step.
Sequencing questions test whether you understand that many security procedures have a non-negotiable order. In incident response, you cannot remediate before you have contained. In risk management, you cannot select controls before you have classified assets. In forensics, you cannot preserve integrity if you have already altered the system. The CISSP rewards the candidate who knows the correct sequence, not just the correct set of actions.
Stem decoding rule for FIRST/NEXT: Ask yourself “What must be true before any other step can be meaningful?” The answer to that question is almost always the correct answer.
Question 1 of 15
Domain 7 — Security Operations
A security analyst discovers evidence of active malware on a workstation while the user is still logged in and the session is live. The organization intends to pursue legal action against the attacker. What should the analyst do FIRST?
- A) Immediately power off the workstation to halt the attack
- B) Capture volatile evidence — memory contents, running processes, and active network connections
- C) Notify the user that their workstation is being taken offline for investigation
- D) Isolate the workstation from the network by disconnecting the ethernet cable
Stem decoding: FIRST + legal action pending = evidence preservation takes sequencing priority. Ask: “What is permanently lost if I do anything else first?” Volatile data — RAM, running processes, network connections — vanishes the instant the system is powered off or network-isolated. Once lost, it cannot be recovered. Answer A destroys all volatile evidence. D (network isolation) also disrupts volatile state and may destroy evidence of active connections. C (user notification) is procedurally fine but not time-sensitive in the way volatile evidence is. B is the only action that preserves what is irreplaceable before taking any other step.
Question 2 of 15
Domain 2 — Asset Security
A cloud storage bucket is discovered containing a mix of regulated personal data, internal confidential documents, and public marketing materials, none of which has been labeled. What should the security team do FIRST?
- A) Encrypt the entire bucket at rest to protect all data regardless of type
- B) Restrict access to the security team until the situation is resolved
- C) Classify and label all data in the bucket before applying any specific controls
- D) Delete the regulated data until a formal retention policy has been established
Stem decoding: FIRST here is a sequencing trap. All four options describe legitimate security actions — the question is about order. Classification is the prerequisite control: you cannot correctly encrypt, correctly restrict access, or correctly apply retention rules without first knowing what each piece of data is and what protection it requires. A applies a uniform control that may be misaligned (over-protecting public data, under-protecting regulated data). B is a temporary containment that prevents work without fixing the problem. D creates potential legal liability by destroying regulated data that may have mandatory retention requirements. C is the only action that makes every subsequent decision meaningful.
Question 3 of 15
Domain 1 — Security & Risk Management
A Business Impact Analysis reveals that a critical payment processing system has a Maximum Tolerable Downtime (MTD) of 4 hours. The organization’s current Recovery Time Objective (RTO) for that system is 6 hours. What should the CISO do NEXT?
- A) Accept the gap as a known risk and document it in the risk register
- B) Commission a full disaster recovery site to guarantee RTO compliance
- C) Formally present the RTO/MTD gap to senior leadership with resource requirements needed to close it
- D) Rerun the BIA with adjusted assumptions to bring the MTD into alignment with current RTO
Stem decoding: NEXT after a discovered RTO > MTD gap signals escalation sequence. MTD is not negotiable — it reflects how long the business can actually survive without the system. Adjusting MTD upward (D) to match a weak RTO is a governance failure; it reverses the purpose of the BIA. Simply accepting the gap (A) without escalation violates the CISO’s obligation to inform leadership of material risk. Immediately commissioning a full DR site (B) is a resource commitment that requires executive authorization — the CISO does not unilaterally spend at that scale. C is the sequentially correct next step: surface the gap formally with the data and resource options needed for an executive decision.
2️⃣
Question Type 2
BEST — Judgment Under Ambiguity
Multiple answers are defensible. Your job is to identify the most complete, most appropriately scoped response given the constraints in the stem. Apply the manager mindset: budget, authority, and risk-cost tradeoff all matter.
BEST-answer questions are where the CISSP most directly tests the manager mindset. The exam is designed so that at least two answer choices are technically correct actions — the distinguishing factor is whether the action is appropriate for the role, the constraint, and the scope defined in the stem. Our dedicated guide on thinking like a manager on the CISSP covers this framework in depth. The short version: ask yourself who has the authority and what outcome does the organization actually need?
Stem decoding rule for BEST: Eliminate options that are correct in a vacuum but wrong for the specific role, scope, or constraint given. The remaining defensible option is your answer.
Practice Questions That Match the Real Exam’s Difficulty Curve
CISSP.app’s adaptive engine automatically escalates BEST-answer and scenario questions as your competency grows — mirroring exactly what the CAT does on exam day. Start your 7-day free trial to experience adaptive difficulty on all 8 domains.
Start Free 7-Day Trial →
No credit card required · 3,000+ questions · All 8 domains · Full rationale for every answer choice
Question 4 of 15
Domain 6 — Security Assessment & Testing
An internal audit reveals that 14 of the organization’s 22 critical systems have not received a formal vulnerability assessment in over 18 months. Budget for the next fiscal year has not yet been approved. The BEST recommendation from the security manager to leadership is:
- A) Immediately commission a penetration test against all 14 systems before year-end
- B) Develop a risk-based vulnerability management program with a defined assessment schedule and submit it as a budgeted initiative
- C) Prioritize the two or three systems most likely to be targeted and assess only those
- D) Assign the security team to run ad hoc vulnerability scans while awaiting budget approval
Stem decoding: BEST + “recommendation to leadership” + pre-budget context = the answer must be both substantively correct AND appropriate for the managerial context. A (immediate pen test) commits resources that have not been approved and conflates penetration testing with vulnerability assessment. C (scope to two or three systems) is reactive risk triage, not a sustainable program. D (ad hoc scans) creates informal processes with no accountability structure and no leadership visibility. B is the BEST answer because it gives leadership what they need to make an informed budget decision, creates a repeatable framework, and properly positions the security team as risk-aware rather than reactive.
Question 5 of 15
Domain 8 — Software Development Security
A development team is three weeks from a planned product release when a critical vulnerability is discovered in a third-party library used throughout the codebase. A vendor patch exists but requires significant refactoring. The BEST response reflects which approach?
- A) Release on schedule; the vulnerability is not yet known to be actively exploited
- B) Formally evaluate the risk: either delay the release or implement verified compensating controls with a committed remediation timeline
- C) Remove the vulnerable library entirely and replace it with in-house code before release
- D) Accept the risk permanently since refactoring introduces the risk of new vulnerabilities
Stem decoding: BEST is a judgment question; it does not require you to know which specific action to take — it requires you to identify the correct decision-making process. A treats “not yet exploited” as a risk treatment, which it is not; it is a statement about current status. C is impractical at three weeks to release and likely introduces greater risk through untested code. D treats acceptance as a permanent posture rather than a time-limited decision with a remediation commitment — which is not formal risk acceptance. B is correct because it describes a structured, documented risk decision: evaluate, choose a path (delay or compensate), and commit to remediation. The CISSP exam consistently rewards formal risk-based process over instinctive technical action.
Question 6 of 15
Domain 3 — Security Architecture & Engineering
A startup is designing a payment processing platform from scratch. Security budget is limited and the team has six months to launch. The BEST approach to building security into the platform is:
- A) Implement all controls required by ISO 27001 before launch to ensure compliance
- B) Conduct a threat model to identify the highest-risk attack surfaces and address those first
- C) Hire a CISO after launch to define the security architecture retrospectively
- D) Treat PCI DSS compliance as the complete security specification for the platform
Stem decoding: BEST + limited budget + time constraint = the correct answer prioritizes high-impact, risk-based security over comprehensive compliance coverage. A (full ISO 27001) is impractical given budget and timeline constraints and introduces compliance overhead before the product is even live. C (post-launch CISO) is the opposite of shift-left security — retrofitting security after design is expensive and leaves gaps during early user exposure. D treats compliance as equivalent to security, which it is not; PCI DSS addresses payment card data specifically, not all attack surfaces. B is correct because threat modeling is precisely the technique designed to allocate limited security resources to the highest-risk surfaces — it is the right tool for the constraint described.
3️⃣
Question Type 3
MOST — Comparative Evaluation
All four options may be correct. MOST requires you to rank them. One answer is correct in more scenarios, with greater effectiveness, or with fewer downsides than the others. Do not stop at “this is correct.” Ask “is this more correct than the others?”
MOST questions are where domain knowledge depth matters most. You cannot rank options without understanding the relative effectiveness of each. The trap is selecting the first plausible-sounding option and moving on. The distinguishing skill is knowing not just that a control works, but how well it works compared to alternatives, and in what context each one outperforms the others. Understanding the eight domain coverage areas deeply is the prerequisite for ranking confidently.
Stem decoding rule for MOST: Eliminate options that address the scenario but less directly or with more limitations. The answer that addresses the exact scenario described with the fewest limitations is almost always correct.
Question 7 of 15
Domain 4 — Communication & Network Security
Of the following firewall types, which is MOST effective at detecting and blocking application-layer attacks such as SQL injection and cross-site scripting?
- A) Stateless packet-filtering firewall
- B) Stateful inspection firewall
- C) Web Application Firewall (WAF)
- D) Circuit-level gateway
Stem decoding: MOST effective for application-layer attacks specifically. A (packet-filtering) inspects only header fields — it has no visibility into payload content where SQL injection and XSS attacks reside. B (stateful inspection) tracks connection state but still does not inspect application payload in the way needed to detect injection attacks. D (circuit-level gateway) operates at the session layer and validates TCP handshakes but does not inspect application data. C is correct because WAFs are specifically designed to inspect HTTP/HTTPS application traffic, parse request and response payloads, and apply rules targeting web application attack patterns. The question’s specificity about application-layer attacks makes C the uniquely correct comparative answer.
Question 8 of 15
Domain 1 — Security & Risk Management
Which risk treatment option is MOST appropriate when the annual cost to mitigate a risk exceeds the annualized loss expectancy of the risk event itself?
- A) Transfer the risk through a cyber insurance policy
- B) Implement compensating controls at a lower cost
- C) Accept the risk, documented with executive acknowledgment
- D) Avoid the risk by eliminating the underlying business activity
Stem decoding: MOST appropriate given the quantitative constraint described (mitigation cost > ALE). A (transfer via insurance) may be appropriate but introduces its own cost (premium) and may still result in total cost exceeding ALE when insurance cost is factored in. B (compensating controls) is a reasonable alternative but is speculative — the question gives no evidence that cheaper compensating controls exist. D (avoidance) eliminates the risk entirely but also eliminates the business activity that generates it, which is the highest-cost option of all when the activity has value. C is MOST appropriate because formal risk acceptance with documented executive sign-off is the correct governance response when the math clearly shows the control costs more than the risk it addresses. The manager’s job is to make defensible decisions, not to always mitigate.
Question 9 of 15
Domain 5 — Identity & Access Management
For protecting access to privileged administrative accounts that manage production infrastructure, which single control is MOST effective as a primary safeguard?
- A) Mandatory password complexity requirements (minimum 20 characters, mixed character types)
- B) Multi-factor authentication (MFA) requiring a second factor independent of the password
- C) Quarterly access recertification to confirm the accounts are still needed
- D) Session recording and real-time monitoring of all privileged account activity
Stem decoding: MOST effective as a primary (single) safeguard for privileged accounts. All four options are legitimate controls; the question asks which one alone provides the greatest protection. A (password complexity) addresses only the knowledge factor and is defeated by credential theft, phishing, or brute force at scale. C (recertification) addresses access provisioning hygiene but does not protect against active account compromise. D (session recording) is a detective control — it identifies abuse after it occurs, not before. B is MOST effective because MFA directly prevents unauthorized authentication even when credentials are compromised, which is the primary attack vector against privileged accounts. Unlike A, it addresses a different attack class; unlike C and D, it is preventive rather than detective.
4️⃣
Question Type 4
EXCEPT / NOT — Elimination Thinking
Three answers are correct. One is wrong. Your job is to find the odd one out. Physically mark NOT or EXCEPT before reading the answer choices. In an EXCEPT question, selecting a correct statement is the wrong answer.
EXCEPT and NOT questions invert your reasoning mode. Your entire exam preparation has trained you to identify correct answers. These questions ask you to do the opposite. The cognitive trap is strong: under time pressure, the moment you see a correct-sounding answer, your instinct is to select it. In an EXCEPT question, that instinct is wrong three out of four times.
Stem decoding rule for EXCEPT/NOT: Before reading answer choices, rephrase the question as its inverse. “Which is NOT a chain of custody element?” becomes “I am looking for something that is NOT a chain of custody element.” Hold that framing as you evaluate each option.
Question 10 of 15
Domain 7 — Security Operations (Forensics)
All of the following are required elements of maintaining a proper chain of custody for digital evidence EXCEPT:
- A) Detailed documentation of who collected the evidence and when
- B) Hash verification to confirm evidence integrity has not been altered
- C) Encryption of all collected evidence using AES-256 before transport
- D) Continuous physical control or secure storage with documented access logging
Stem decoding: EXCEPT = find the one that does NOT belong to chain of custody. Rephrase: you are looking for something that is not a required chain of custody element. A (collection documentation) is a core chain of custody requirement. B (hash verification) establishes and verifies evidence integrity — essential for admissibility. D (physical control + access logging) is the definition of maintaining chain of custody. C describes encryption during transport — which is a security best practice for protecting evidence confidentiality, but it is not a chain of custody requirement. Chain of custody is about provenance (who had it, when, and whether it was altered), not about confidentiality protection. This is the correct EXCEPT answer.
Question 11 of 15
Domain 6 — Security Assessment & Testing
A vulnerability assessment engagement typically includes all of the following activities EXCEPT:
- A) Scanning systems against known CVE databases to identify unpatched vulnerabilities
- B) Reviewing patch levels and configuration states against vendor security advisories
- C) Actively exploiting discovered vulnerabilities to demonstrate real-world impact
- D) Generating a prioritized report of discovered weaknesses with remediation recommendations
Stem decoding: EXCEPT = find the activity that does NOT belong in a vulnerability assessment. A (CVE scanning), B (patch review), and D (reporting) are all standard VA deliverables. C describes active exploitation — which is the defining characteristic of a penetration test, not a vulnerability assessment. This is one of the most commonly confused distinctions in the CISSP exam: vulnerability assessments identify and report weaknesses; penetration tests actively verify exploitability. A professional VA engagement explicitly excludes exploitation to stay within scope and avoid unintended production impact. Selecting C as the EXCEPT answer correctly distinguishes VA from pen test methodology.
Question 12 of 15
Domain 3 — Security Architecture & Engineering
Which of the following is NOT a property of the Biba integrity model?
- A) No write up: subjects cannot write to objects at a higher integrity level
- B) No read down: subjects cannot read from objects at a lower integrity level
- C) Simple security property: subjects cannot read objects at a higher sensitivity level
- D) Invocation property: subjects cannot request services from objects at a higher integrity level
Stem decoding: NOT = find the property that does not belong to Biba. A (no write up), B (no read down), and D (invocation property) are all genuine Biba model properties, which protect data integrity by preventing lower-integrity subjects from contaminating higher-integrity objects. C describes the Simple Security Property — which belongs to the Bell-LaPadula model, which protects confidentiality (no read up to prevent unauthorized information disclosure). Biba and Bell-LaPadula are frequently tested together precisely because they mirror each other: Bell-LaPadula protects confidentiality, Biba protects integrity, and they enforce opposite read/write restrictions. Recognizing which property belongs to which model is the specific knowledge the CISSP tests in Domain 3.
5️⃣
Question Type 5
Scenario-Based — Context Before Judgment
The scenario is not background reading — it is a constraint delivery mechanism. Read the last sentence first to know what is being asked. Then read the scenario to identify the constraints that narrow the correct answer. Wrong answers are usually correct in a different context.
Scenario questions are the highest-difficulty question type on the CISSP. They present a paragraph of context that contains specific constraints — a role definition, a regulatory environment, a timeline, a resource limitation — and then ask a question that can only be answered correctly by applying those constraints. Candidates who answer the general question instead of the scenario-specific question will consistently choose a plausible but wrong answer.
Stem decoding rule for scenarios: Read the last sentence first. Then scan the scenario for constraint keywords: the role of the person answering, any legal or regulatory references, time pressure, budget limits. Wrong answers in scenario questions are correct in a different context.
Question 13 of 15
Domain 1 — Security & Risk Management (BCP)
A financial institution has completed a major corporate merger. The combined organization now operates across three countries with different privacy and data protection regulations. The security manager has been asked to update the Business Continuity Plan to reflect the expanded organization. Which activity should receive the HIGHEST PRIORITY?
- A) Updating technical recovery procedures for all merged IT systems and infrastructure
- B) Identifying and mapping all regulatory requirements applicable across each jurisdiction
- C) Conducting a joint Business Impact Analysis with the merged entity’s senior leadership
- D) Appointing a BCP coordinator for each geographic region to own local plan execution
Stem decoding: Scenario constraints: three jurisdictions + different regulations + financial institution. These constraints are not decorative — they define the answer. C (joint BIA) is normally the foundational step for any BCP update, and in most scenarios it would be the FIRST action. But the multi-jurisdictional regulatory context changes the priority: you cannot produce a valid BIA for a financial institution across three regulatory jurisdictions without first knowing what mandatory recovery requirements each jurisdiction imposes. Regulatory obligations define minimum recovery thresholds that the BIA must then validate against. B is HIGHEST PRIORITY because it is the prerequisite that makes the BIA results actionable for a compliance-obligated entity. In a single-jurisdiction scenario, C would be correct. The scenario constraint flips the order.
Question 14 of 15
Domain 2 — Asset Security / Domain 5 — IAM
A hospital’s security team discovers that an employee in the medical records department has been accessing patient records for individuals who are not in their assigned caseload, over a period of six months. All accesses were within the employee’s provisioned permission level. No data has been modified. Which of the following MOST ACCURATELY describes this situation?
- A) Privilege escalation — the employee is accessing resources beyond their permission level
- B) Insider threat through authorized access misuse — the access was permitted by controls but violated appropriate use policy
- C) Data exfiltration attack — the repeated access pattern indicates intent to steal data
- D) Access control misconfiguration — the permissions model is too broad for the role
Stem decoding: MOST ACCURATELY is a comparative modifier on a scenario that contains a critical constraint: “All accesses were within the employee’s provisioned permission level.” A (privilege escalation) is eliminated immediately — the stem explicitly states no escalation occurred. C (data exfiltration) is speculative; repeated access does not confirm exfiltration, and the stem states no modification occurred. D (misconfiguration) is partially correct — the permissions scope may be too broad — but it describes a systemic policy issue, not the specific incident at hand. B is MOST ACCURATE because it correctly names the phenomenon: insider threat via authorized access. The employee is using legitimately provisioned credentials for unauthorized purposes — which is a policy violation, a HIPAA concern, and a disciplinary/legal matter, but not a permissions control failure in the narrow technical sense.
Question 15 of 15
Domain 7 — Security Operations (Incident Response)
During a forensic investigation, an analyst confirms that an attacker maintained persistent access to an HR server for 90 days using a rootkit that suppressed antivirus alerts and modified system logs. The server contained employee PII including SSNs and salary data. Forensic analysis finds no evidence of data exfiltration. As CISO, which action regarding breach notification is MOST APPROPRIATE?
- A) No notification is required; absence of exfiltration evidence means no breach of personal data occurred
- B) Engage legal counsel to determine notification obligations under applicable breach notification laws before any communication decision
- C) Immediately notify all employees whose records were stored on the server, as PII was at risk
- D) Notify law enforcement only; employee notification is not required absent confirmed exfiltration
Stem decoding: MOST APPROPRIATE + CISO role + legal/regulatory context (PII breach). The constraint “no evidence of exfiltration” is a trap. Most breach notification laws (GDPR, CCPA, HIPAA, US state laws) define a breach as unauthorized access to personal data, not as confirmed exfiltration. A rootkit with 90-day persistence on a server containing PII almost certainly constitutes a reportable breach under multiple frameworks — but the exact obligation depends on applicable law. A assumes absence of evidence is evidence of absence, which is legally dangerous. C assumes immediate notification without legal review, which may itself violate regulatory procedures. D restricts notification without legal basis. B is MOST APPROPRIATE because legal counsel is the correct gatekeeper for notification decisions involving potential regulatory obligations. The CISSP manager mindset: know when to escalate to legal rather than making compliance calls unilaterally.
5 Distractor Traps That Exploit Question-Type Confusion
Once you understand question types, you can start recognizing the specific distractor patterns (ISC)² uses to exploit type confusion. These five patterns appear repeatedly across all question types and domains.
Trap 1: The “Important But Not First” Distractor
In FIRST/NEXT questions, one distractor is always the most important or most impactful action — just not the first. Candidates select it because it feels like the right priority. The correct answer is almost always the logically prerequisite action, even if it seems less significant.
Trap 2: The “Technical Expert, Wrong Role” Distractor
In BEST questions, one distractor is what a technical practitioner would do, not what a security manager with organizational accountability would do. If the answer involves the security team directly executing a technical fix without escalating or documenting, it is almost certainly wrong for a CISSP-level scenario.
Trap 3: The “Correct In A Different Context” Distractor
In scenario questions, wrong answers are often correct responses to a generic version of the question — without the constraints the scenario introduced. If you answer the general question instead of the scenario-specific one, you select this distractor. Always apply the scenario’s constraints before finalizing your answer.
Trap 4: The “True Statement, Wrong Question” Distractor in EXCEPT Questions
EXCEPT questions always include three true statements and one false (or non-applicable) one. The three true statements are placed there specifically to attract candidates who have not registered the inversion. If you find yourself selecting an answer because it “sounds right,” stop and check whether you have an EXCEPT in the stem.
Trap 5: The “Speculative Action” Distractor in MOST Questions
In MOST questions, one distractor is typically an option that could be more effective — but only if an unstated assumption is true (e.g., “compensating controls at a lower cost” assumes cheaper controls exist). The correct MOST answer addresses the scenario as described, without requiring assumptions the stem did not provide.
✓ Build the Habit Before Exam Day
Stem-reading is a mechanical skill that takes about two to three weeks of deliberate practice to make automatic. Start by marking stem keywords in writing on every practice question for the next two weeks — even if it feels slow. Once the habit is automatic, your pacing on exam day will not suffer because you will be immediately in the correct reasoning mode for each question. For a full structured practice schedule, see our 90-day CISSP study plan and our guide on domain-by-domain question targets.
Adaptive Practice That Escalates With You
CISSP.app’s question engine automatically surfaces harder BEST-answer and scenario questions as your domain scores improve — matching the CAT’s difficulty escalation in your practice sessions. Try it free for 7 days with full access to all question types across all 8 domains.
Try CISSP.app Free →
No credit card required · Full answer explanations for all 4 choices · Weak-area analysis · CCSP and CISM included
FAQ: CISSP Practice Question Types
What do the words FIRST, BEST, and MOST mean on the CISSP exam?
These stem words are deliberate reasoning signals. FIRST and NEXT indicate sequencing questions — identify the logically prerequisite action before any other. BEST signals judgment under ambiguity, where multiple options are partially valid and you must identify the most defensible one given the stem’s constraints. MOST signals comparative evaluation; all options may be correct, but one is more effective or more accurate than the others. Each requires a different framework before you read a single answer choice.
Why do CISSP EXCEPT/NOT questions trip up experienced candidates?
EXCEPT and NOT questions invert your reasoning mode entirely. Most exam preparation trains you to identify correct answers. In an EXCEPT question, three of the four options are correct — your job is to find the outlier. Under time pressure, the instinct to select a familiar, correct-sounding answer is strong. Physically marking NOT or EXCEPT in the stem before reading answer choices is the single most effective habit for avoiding this trap.
How should I approach CISSP scenario-based questions differently?
Read the last sentence of the scenario first — it contains the actual question being asked. Then read the scenario paragraph specifically to identify constraints: the role defined, any regulatory references, budget limitations, or timing pressure. Most wrong answers in scenario questions are correct actions in a general context but wrong given the scenario’s specific constraints. Always answer the constrained question, not the general one.
How many free CISSP practice questions do I need to improve my stem-reading skill?
Stem-reading is a habit, not a knowledge area — it improves rapidly with deliberate practice. Consistently annotating stem keywords across 50 to 100 carefully analyzed questions is typically enough to make the habit automatic. The key is active annotation before evaluating any answer choice, not passive reading. For domain-specific volume targets, see our domain question calculator.
Can the CISSP adaptive exam give me more of a question type I am weak on?
The CISSP CAT adapts based on domain competency, not question-type performance. However, at higher difficulty levels — which the CAT escalates to as you demonstrate competence — complex scenario and BEST-answer questions appear more frequently. Mastering question-type reasoning directly improves your performance at the difficulty levels the adaptive algorithm targets when you are performing well.
CISSP.app Blog