ISC2 CISSP hands-on labs
Governance work in a register: data ownership, control testing, access review and the provisioning lifecycle.
35 labs you run in the browser: 10 guided, 15 assisted, 9 challenge, 1 capstone. About 5 hours of authored lab time. 1 opens to any signed-in account without a lab grant.
35
labs
10
guided
steps in order
10
goal only
challenge and capstone
1
free tasters
signed-in, no grant
What you practise
Exam facts and study plan- Risk register and control sheets· you click35 labs
Every lab in this set
Title, scenario summary, skills and tool. The steps and the write-up stay in the app.
Fix the clocks before the timeline
Free tasterGuided · Quick · 5 min · Risk register and control sheets
Last month the review team could not line up an authentication event with the firewall event that followed it. Two thirds of servers run without time synchronisation…
log managementtime synchronisationevent correlationincident timeline
Put a retention limit on the analytics export share
ProGuided · Quick · 5 min · Risk register and control sheets
The analytics share holds every quarterly export since 2023, because nothing ever deletes them. That is three years of customer order data sitting past the retention period the privacy…
data lifecycleretentionend of liferisk register
Register the comms room door held open
ProGuided · Quick · 5 min · Risk register and control sheets
The cleaners prop the comms room door open for an hour each evening so they can move a trolley in and out…
physical securityaccess controlalarm monitoringrisk register
Register the sign in nobody gets alerted about
ProGuided · Quick · 5 min · Risk register and control sheets
Someone signed in to the finance portal from two countries in one hour last month. The sign ins were both recorded, both looked normal on their own…
detectionmonitoringSIEM rulesrisk register
Close the management door on the guest network
ProGuided · Quick · 6 min · Risk register and control sheets
A consultant on the guest wifi opened a browser and found the hypervisor management page answering with a vendor default password…
network segmentationmanagement planeleast exposurewireless isolation
Register laptops that left without a wipe record
ProGuided · Quick · 6 min · Risk register and control sheets
Sixty laptops went to a reseller in the spring and the paperwork shows a purchase order and nothing else. No wipe certificate, no serial list, no record of who approved the release…
asset lifecycleend of lifemedia sanitisationdata ownership
Register the admin account four engineers share
ProGuided · Quick · 7 min · Risk register and control sheets
The finance system has one administrator account. Four engineers know the password, it has not changed since the system went live…
accountabilityprivileged accessprovisioning lifecycleauthorisation
Register the backup key stored with the backup
ProGuided · Quick · 7 min · Risk register and control sheets
The reporting service encrypts its nightly backups, and the key file sits in the same object store prefix as the backups…
cryptographic lifecyclekey managementencryption at restrisk register
Register the certificate that field devices trust
ProGuided · Quick · 7 min · Risk register and control sheets
Four hundred field devices carry a firmware image that pins the intermediate certificate authority used by the device management portal. The intermediate expires in sixty days…
cryptographic lifecyclecertificate expirypinningcontrol mapping
Register a risk for a share nobody owns
ProGuided · Quick · 8 min · Risk register and control sheets
An analytics team exports customer order data to a file share every night. The share was created for a project that ended, and nobody has claimed it since…
risk registerdata ownershiprisk response
Add a rollback step before the next change
ProAssisted · Quick · 5 min · Risk register and control sheets
The last three changes to the order service went live with no rollback step and nobody named as on call. One of them took four hours to reverse by hand while the order line waited…
change managementrollbackapprovaloperational resilience
Register the code review that approves itself
ProAssisted · Quick · 5 min · Risk register and control sheets
The payment service requires two approvals before a merge. It also lets an author approve their own change, and two of the last ten changes went in that way…
control testingcode reviewsegregation of dutiesrisk register
Register the personal sync folder that holds work files
ProAssisted · Quick · 5 min · Risk register and control sheets
Staff keep the customer list and the price book in a personal cloud sync folder so they can work from home. The folder syncs to personal phones, no company agreement covers it…
data life cycledata locationsharingretention
Register the phone number change that skips the check
ProAssisted · Quick · 5 min · Risk register and control sheets
Users change the phone number used for one time codes from the login page with the password alone. No notice goes to the old number and nothing delays the change…
multi factor authenticationenrolmentaccount takeoveridentity proofing
Score the password store that can be cracked
ProAssisted · Quick · 5 min · Risk register and control sheets
The customer login service stores passwords as unsalted SHA-256 in a shared library used by three services. Last month's database backup sits on a share the analytics team can read…
password storagehashingkey lifecyclecryptographic design
Stop giving new starters the last person's rights
ProAssisted · Quick · 5 min · Risk register and control sheets
When someone leaves, the manager asks for the replacement to be given the same access as the person who left…
least privilegerole based accessjoiner processaccess review
Close the contractor account that kept its admin role
ProAssisted · Quick · 6 min · Risk register and control sheets
A contractor left in March and the account still signs in through the supplier's identity provider with the platform admin role…
provisioning lifecycledeprovisioningfederated identityaccess review
Move the courier data exposure to the contract
ProAssisted · Quick · 6 min · Risk register and control sheets
The courier integration sends delivery names, addresses and phone numbers to a logistics partner. The partnership runs on a purchase order and a handshake email…
risk treatmentrisk transferthird party riskrisk register
Register the finding closed on a hunch
ProAssisted · Quick · 6 min · Risk register and control sheets
A critical finding on the reporting portal was closed as a false positive by the platform lead with the note internal only. Nobody ran a test and nobody attached evidence…
vulnerability assessmentfalse positiveevidencefinding triage
Register the logs that age out before the review
ProAssisted · Quick · 6 min · Risk register and control sheets
The last incident review opened a case from five weeks earlier and found seven days of events. Policy asks for ninety. The pipeline was never changed after a storage upgrade…
logginglog retentionincident investigationmonitoring
Register the paper forms in the stockroom
ProAssisted · Quick · 6 min · Risk register and control sheets
The digital enrolment form tokenises card numbers, and everyone agreed that closed the subject. Then a new starter found two boxes of paper forms in the stockroom…
data handlingdata lifecyclephysical mediaretention
Register the report that shrinks the top risks
ProAssisted · Quick · 6 min · Risk register and control sheets
The local register scores risk on a three by three grid. The group report expects five by five and rescales whatever arrives…
risk methodologyrisk aggregationgovernance reportingrisk register
Register the scanners on the old wireless standard
ProAssisted · Quick · 6 min · Risk register and control sheets
The handheld scanners in the warehouse still associate to access points running WEP, because the stock system only speaks the old protocol…
wireless securitysegmentationlegacy equipmentrisk register
Score the service the penetration test never saw
ProAssisted · Quick · 6 min · Risk register and control sheets
The payments microservice went live in November, after the test window was agreed. It was never in scope, so the clean report on the estate tells leadership nothing about the service that…
assessment scopepenetration testingcontrol testingrisk register
The access review that closed on paper
ProAssisted · In-depth · 30 min · Risk register and control sheets
The quarterly access review came back clean. Every line manager signed the attestation, the cover note went to the risk committee, and the committee closed four items on the strength of it…
risk registerprovisioning lifecycleaccess reviewthird party federation
Move the acceptance to the person who owns the data
ProChallenge · Quick · 6 min · Risk register and control sheets
The order archive sends unencrypted exports to a partner file server every night. The security team signed an acceptance in June so the partner integration could stay live until the partner…
risk appetiterisk acceptanceaccountabilitydata ownership
Register the build that trusts a package name
ProChallenge · Quick · 6 min · Risk register and control sheets
A helper package that the checkout service installs at build time was replaced last week by a copy published under a name one letter away from the original…
software supply chaindependency managementbuild integrityrisk register
Register the deploy token that is still in the history
ProChallenge · Quick · 6 min · Risk register and control sheets
A deploy token was committed to the payment service repository in a config file and removed six commits later, so the current branch looks clean. The token still works…
secure software pipelinesecret scanningcredential exposureappsec testing
Register the firewall changes nobody recorded
ProChallenge · Quick · 6 min · Risk register and control sheets
Thirty percent of firewall changes last quarter were made under the emergency route and none of them produced a ticket…
change managementemergency changeconfiguration controlrisk register
Register the partner domain anyone can claim
ProChallenge · Quick · 6 min · Risk register and control sheets
The partner sign in trusts any assertion whose address ends in the partner name. Last year the partner sold a regional business and its subdomain went with it…
federationthird party identitytrust configurationrisk register
Retire the package registry nobody patches
ProChallenge · Quick · 6 min · Risk register and control sheets
Every build pulls internal libraries from a package registry that has had no vendor patches since 2024. The build hosts run the old runtime the registry depends on…
software supply chainbuild pipelinedependency managementsecure development
Score the flat network under the tills
ProChallenge · Quick · 6 min · Risk register and control sheets
The store network carries till traffic, the guest wifi and the back office on one flat segment. A guest device can reach a till…
network segmentationrisk registercontrol mappingpayment data
Bring three inherited risks into the group register
ProChallenge · In-depth · 32 min · Risk register and control sheets
The logistics firm bought in March kept its risks in a spreadsheet that two people opened. The integration board wants the three open items carried into the group register with a score…
risk registerrisk treatmentdata ownershiptest data
Test the recovery plan before the board signs the statement
ProChallenge · In-depth · 36 min · Risk register and control sheets
The recovery plan for the scheduling platform was rewritten after the last audit and nobody has opened it since. The platform has moved to a new database twice in that time…
risk treatmentcontrol testingrecovery exercisechain of custody
Clear the exceptions that outlived their reason
ProCapstone · In-depth · 38 min · Risk register and control sheets
The laptop migration closed in June last year and the file transfer exception it needed is still live on eleven servers. Another exception was renewed twice by the ticketing rule…
risk acceptancepolicy exceptioncompensating controlcontrol testing
Where to go next
Every certification with labsCISSP lab questions
There are 35 labs: 10 guided, 15 assisted, 9 challenge, 1 capstone. Together they carry about 5 hours of authored lab time, and 1 free taster lab.
Practise CISSP the way the exam asks
Open a guided lab first, then work the challenge set with the hints off. Every lab links back to the lesson it tests.
Free tier, no card. Pro starts with a 7-day trial; a card is required and you can cancel before day 7.