CSS Practice Test

The Certified Security Sentinel (CSS) is a Mile2 certification for people building a career in security work. This page gives you free practice sets sorted by topic, worked explanations of sample questions, a study plan, and plain answers about the exam format, the 70% passing score, retakes and how long the certification lasts.

CSS Exam at a Glance

What the CSS is and how it works

According to Mile2, “Most Mile2 certification exams contain 100 questions and allow two hours.”^[1]

The Certified Security Sentinel (CSS) is a certification from Mile2, which is the official body for this exam. It is meant for people who want to show they can work with core security ideas such as risk, threats, access control, networks and incident handling. Our practice sets follow those themes, but they are written by us and are not real exam questions.

Delivery is online. Mile2 says its certification exams are taken through your Mile2 account, and most standard exams can be started when you are ready, with no appointment with a live proctor. That makes the exam unproctored, so set aside a quiet block of time before you begin.

The exam has 100 questions and a time window of 120 minutes. You need a minimum score of 70% to earn the certification. If you buy the Exam Combo, a second attempt is included at no extra charge. If you do not pass after both included attempts, you must purchase additional exam access.

Mile2 lists no prerequisites for its course, so you do not need another certification before you start. A Mile2 certification is generally valid for 3 years.

These figures come from Mile2's general pages, which describe most of its exams. Details can differ for a specific product or bundle, so check the current CSS listing on mile2.com before you book.

Worked examples: how to reason through CSS questions

These are practice questions written for this site, not questions from the real exam. Each explanation shows why the right answer is right and why the others are wrong.

Example 1

Question: Which cloud service model gives customers the LEAST control over the underlying infrastructure?

1. Infrastructure as a Service (IaaS)
2. Platform as a Service (PaaS)
3. Software as a Service (SaaS)
4. Function as a Service (FaaS)

Answer: C. Software as a Service (SaaS)

Explanation:

Software as a Service (SaaS) is correct. The provider runs the infrastructure, middleware, runtime and the application itself, so the customer only controls their own data and user access settings.

IaaS is wrong because the customer manages the operating system, runtime and applications on rented infrastructure. PaaS is wrong because the customer still controls the application code and its configuration. FaaS is wrong because the customer still writes and deploys the functions, even though the servers are hidden.

Rule to remember: the further up the stack the provider manages, the less control the customer has. Rank the models by how much each one hands over, and the answer to any question of this type follows from that order.

Example 2

Question: What is the primary purpose of a next-generation firewall (NGFW) compared to a traditional stateful firewall?

1. Deep packet inspection and application-layer filtering
2. Faster packet forwarding speeds
3. Support for IPv6 only
4. Hardware-based encryption offloading

Answer: A. Deep packet inspection and application-layer filtering

Explanation:

Deep packet inspection and application-layer filtering is correct. A traditional stateful firewall decides mostly on ports, protocols and connection state. A next-generation firewall looks inside the traffic and can recognise the application, so it can allow or block based on what is actually being used.

Faster forwarding is wrong because speed is a hardware and tuning matter, not the defining feature. IPv6-only support is wrong because it describes a limitation, not a purpose. Hardware encryption offloading is wrong because it is a performance feature that other devices can have too.

Rule to remember: when a question asks what makes a newer control different from an older one, pick the capability that changes what it can see or decide, not a speed or hardware detail.

Example 3

Question: Which attack targets authentication systems by using previously captured valid authentication tokens?

1. Pass-the-ticket / pass-the-hash attack
2. Phishing attack
3. Password spraying
4. SQL injection

Answer: A. Pass-the-ticket / pass-the-hash attack

Explanation:

Pass-the-ticket or pass-the-hash is correct. These attacks reuse a captured authentication token, such as a password hash or a Kerberos ticket, to act as the victim without ever learning the password.

Phishing is wrong because it tricks a person into giving up credentials, rather than replaying a token already stolen. Password spraying is wrong because it guesses common passwords across many accounts. SQL injection is wrong because it attacks a database through unsafe input, not an authentication token.

Rule to remember: look for the keyword in the question. A captured valid token that is replayed points to pass-the-hash or pass-the-ticket. Guessing points to spraying or brute force, and deception points to phishing.

How to use these practice tests

Start with the official material from Mile2, so you know what the certification covers and how the exam is delivered. Then use the practice sets to find where you are weak.

1. Take a set on a topic you already know, such as Network Security & Architecture, to get used to the question style.
2. Move to your weaker topics, for example Cryptography & Data Protection or Identity & Access Management. Read every explanation, including the ones for questions you got right.
3. Write a short note for each miss: what the question was really testing and which rule you forgot.
4. Cover the process side with Security Risk Assessment & Analysis and Incident Response & Recovery.
5. Repeat the sets where you scored lowest until your results are steady, then try the mixed practice test under a time limit to match the real window of 120 minutes.

Keep in mind that the exam is unproctored and online, so practise in the same quiet setting you plan to use on test day.

Sources & last verified

1. Mile2 — number of questions, retake policy, validity, delivery (official source). “Most Mile2 certification exams contain 100 questions and allow two hours.” Verified Oct 31, 2026.
2. Mile2 — time limit, passing score (official source). “Certification Exams are timed. Each exam has a 2 hour time window. A minimum score of 70% is required to secure certification.” Verified Oct 31, 2026.
3. niccs.cisa.gov — eligibility (official source). “Course Prerequisites None” Verified Oct 31, 2026.

How we verify: editorial & fact-checking policy. Report an error: contact us.