The Certified Security Sentinel (CSS) is a Mile2 certification for people building a career in security work. This page gives you free practice sets sorted by topic, worked explanations of sample questions, a study plan, and plain answers about the exam format, the 70% passing score, retakes and how long the certification lasts.
The CSS has 100 questions and takes about 2 hours[1][2] (Mile2, verified Oct 31, 2026).
Numbers in brackets link to the official sources listed under Sources & last verified. Dates that have passed are removed automatically.
| Item | Detail | Source · Verified |
|---|---|---|
| Number of questions | 100 questions[1] | Mile2 · Oct 31, 2026 |
| Time limit | 120 minutes[2] | Mile2 · Oct 31, 2026 |
| Passing score | 70%[2] | Mile2 · Oct 31, 2026 |
| Retake policy | Second attempt included free[1] | Mile2 · Oct 31, 2026 |
| Validity | 3 years[1] | Mile2 · Oct 31, 2026 |
| Delivery | Online unproctored[1] | Mile2 · Oct 31, 2026 |
| Eligibility | No prerequisites[3] | niccs.cisa.gov · Oct 31, 2026 |
According to Mile2, “Most Mile2 certification exams contain 100 questions and allow two hours.”[1]
The Certified Security Sentinel (CSS) is a certification from Mile2, which is the official body for this exam. It is meant for people who want to show they can work with core security ideas such as risk, threats, access control, networks and incident handling. Our practice sets follow those themes, but they are written by us and are not real exam questions.
Delivery is online. Mile2 says its certification exams are taken through your Mile2 account, and most standard exams can be started when you are ready, with no appointment with a live proctor. That makes the exam unproctored, so set aside a quiet block of time before you begin.
The exam has 100 questions and a time window of 120 minutes. You need a minimum score of 70% to earn the certification. If you buy the Exam Combo, a second attempt is included at no extra charge. If you do not pass after both included attempts, you must purchase additional exam access.
Mile2 lists no prerequisites for its course, so you do not need another certification before you start. A Mile2 certification is generally valid for 3 years.
These figures come from Mile2's general pages, which describe most of its exams. Details can differ for a specific product or bundle, so check the current CSS listing on mile2.com before you book.
Prepare for the CSS - Certified Security Sentinel exam with our free practice test modules. Each quiz covers key topics to help you pass on your first try.
These are practice questions written for this site, not questions from the real exam. Each explanation shows why the right answer is right and why the others are wrong.
Question: Which cloud service model gives customers the LEAST control over the underlying infrastructure?
Answer: C. Software as a Service (SaaS)
Explanation:
Software as a Service (SaaS) is correct. The provider runs the infrastructure, middleware, runtime and the application itself, so the customer only controls their own data and user access settings.
IaaS is wrong because the customer manages the operating system, runtime and applications on rented infrastructure. PaaS is wrong because the customer still controls the application code and its configuration. FaaS is wrong because the customer still writes and deploys the functions, even though the servers are hidden.
Rule to remember: the further up the stack the provider manages, the less control the customer has. Rank the models by how much each one hands over, and the answer to any question of this type follows from that order.
Question: What is the primary purpose of a next-generation firewall (NGFW) compared to a traditional stateful firewall?
Answer: A. Deep packet inspection and application-layer filtering
Explanation:
Deep packet inspection and application-layer filtering is correct. A traditional stateful firewall decides mostly on ports, protocols and connection state. A next-generation firewall looks inside the traffic and can recognise the application, so it can allow or block based on what is actually being used.
Faster forwarding is wrong because speed is a hardware and tuning matter, not the defining feature. IPv6-only support is wrong because it describes a limitation, not a purpose. Hardware encryption offloading is wrong because it is a performance feature that other devices can have too.
Rule to remember: when a question asks what makes a newer control different from an older one, pick the capability that changes what it can see or decide, not a speed or hardware detail.
Question: Which attack targets authentication systems by using previously captured valid authentication tokens?
Answer: A. Pass-the-ticket / pass-the-hash attack
Explanation:
Pass-the-ticket or pass-the-hash is correct. These attacks reuse a captured authentication token, such as a password hash or a Kerberos ticket, to act as the victim without ever learning the password.
Phishing is wrong because it tricks a person into giving up credentials, rather than replaying a token already stolen. Password spraying is wrong because it guesses common passwords across many accounts. SQL injection is wrong because it attacks a database through unsafe input, not an authentication token.
Rule to remember: look for the keyword in the question. A captured valid token that is replayed points to pass-the-hash or pass-the-ticket. Guessing points to spraying or brute force, and deception points to phishing.
Start with the official material from Mile2, so you know what the certification covers and how the exam is delivered. Then use the practice sets to find where you are weak.
Keep in mind that the exam is unproctored and online, so practise in the same quiet setting you plan to use on test day.
Mile2 says most of its certification exams contain 100 questions and allow a time window of 120 minutes. That figure comes from its general pages, so confirm it for CSS on the current Mile2 listing. Practise at a steady pace so you can finish within the full window.
Mile2 requires a minimum score of 70% to secure certification. The exam is timed, with a 120 minute window, so accuracy and pace both matter. Use the practice sets to find weak topics early, and aim to score well above that line before you book.
No live proctor is needed for most standard Mile2 exams. They are taken online through your Mile2 account and can be started when you are ready, without an appointment. Because nobody guides you through it, check your connection and set up a quiet space before you begin.
Yes. Mile2 says the Exam Combo includes a second attempt at no additional charge. If you do not pass after both included attempts, you must purchase additional exam access. Check the current Mile2 terms for the price and conditions that apply to your purchase.
Mile2 lists no course prerequisites, so you do not need another certification first. You can begin studying right away. Confirm the current entry requirements on mile2.com before you register, since the exam body's own pages are the final word.
A Mile2 certification is generally valid for 3 years. The word generally matters here, so check the terms on your own certificate or on mile2.com for the exact renewal rules that apply to CSS.
How we verify: editorial & fact-checking policy. Report an error: contact us.