(ISC)² · Free Practice Questions · Last reviewed May 2026
30real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
An ISSEP is conducting a quantitative risk assessment for a mission-critical database. The Annualized Rate of Occurrence (ARO) is 0.5, and the Single Loss Expectancy (SLE) is $100,000. What is the Annualized Loss Expectancy (ALE)?
$200,000
$50,000
This is the correct calculation of SLE * ARO.
$500,000
$100,000
An ISSEP is performing a supply chain risk assessment for an IOT-based sensor array. Which finding poses the highest systemic risk to the overall system integrity?
The sensor housing is not tamper-evident.
The sensors use an older version of Bluetooth.
The sensor firmware is not signed.
Lack of code signing at the supply chain level is a critical vulnerability that allows malicious code to be executed on the system.
The vendor does not provide a Service Level Agreement (SLA).
You are assessing an Engineered System that utilizes a Trusted Platform Module (TPM) for secure boot. A scan reveals that the firmware version is outdated and susceptible to a known key-injection vulnerability. Which action should the ISSEP prioritize?
Update the security policy to include manual verification of boot logs.
Configure an IDS to block unauthorized firmware update attempts.
Disable TPM-based secure boot until the vendor releases a patch.
Perform a firmware update using the manufacturer's signed secure update process.
Firmware updates are the only way to patch hardware-level vulnerabilities in the TPM/secure boot mechanism.
An engineering team is designing a new cloud infrastructure. To ensure the system complies with FIPS 140-3, which action must the ISSEP verify during the design phase?
That the system uses TLS 1.3 for data in transit.
That the cloud management console uses Multi-Factor Authentication (MFA).
That all cryptographic modules utilized by the system are FIPS 140-3 validated.
This is the core requirement of FIPS 140-3 compliance for an engineered system.
That the cloud provider's storage is encrypted at rest.
You are analyzing a proprietary SCADA system's threat landscape. The system uses a non-standard protocol that prevents the use of traditional deep packet inspection (DPI) tools. Which method provides the most effective risk reduction?
Enforce physical network isolation using unidirectional security gateways to separate the control network from the enterprise network.
Data diodes physically prevent data ingress, effectively mitigating network-based threats when DPI is not an option.
Replace the proprietary protocol with OPC-UA to enable standard security monitoring.
Implement a host-based firewall on the SCADA master station.
Deploy an intrusion detection system (IDS) that uses behavioral pattern matching.
You are evaluating the risk of an Artificial Intelligence (AI) model deployment. The model is susceptible to 'model inversion' attacks, where an attacker can reconstruct sensitive training data. What is the most effective engineering control to prevent this?
Encrypt the model weights at rest.
Implement rate limiting on the model's API.
Retrain the model on a smaller, obfuscated dataset.
Apply differential privacy techniques to the training process.
Differential privacy provides a mathematical guarantee against the reconstruction of individual data points.
Want more Risk Management practice?
Practice this domainAn administrator needs to wipe a decommissioned laptop hard drive. Which method meets the NIST 800-88 'Purge' standard for magnetic media?
Deleting partitions
OS reinstallation
Degaussing
Degaussing removes magnetic domains, effectively purging the data.
File system encryption
You are utilizing Terraform to manage infrastructure as code. To ensure security-critical changes are not committed to production without authorization, which feature should you implement?
Terraform Refresh
Provider Aliases
State Locking
Sentinel Policy-as-Code
Sentinel allows automated, mandatory security checks during the plan phase.
You are configuring a CI/CD pipeline in GitLab to ensure security-critical changes are verified. Which mechanism ensures that only authorized engineers can merge changes to the master branch?
Global Runner tags
Pipeline schedules for automated auditing
Protected Branches with Merge Request approvals
This feature enforces mandatory code reviews and restricts who can merge to the protected branch.
Webhook integration with Jira
In a Kubernetes environment, you are updating a security sidecar container. Which deployment strategy ensures zero downtime while maintaining security posture?
Recreate
Canary Release
Blue/Green Deployment
RollingUpdate
RollingUpdate replaces pods gradually, maintaining service availability.
What is the first step when preparing a system for secure disposal?
Inventory the assets
Accurate inventory is the foundational step for any disposal lifecycle.
Run a virus scan
Physically destroy the hardware
Send it to recycling
You are decommissioning an AWS EBS volume containing sensitive data. To comply with NIST SP 800-88, which action is required after logical deletion?
Perform a bit-level wipe using dd
Schedule the deletion of the associated KMS CMK
Deleting the KMS key renders the data cryptographically shredded and unrecoverable.
Run an Amazon Inspector scan
Reformat the filesystem using mkfs
Want more Secure Operations Change Management And Disposal practice?
Practice this domainDuring the design of a PKI hierarchy for a highly classified system, the ISSEP needs to ensure that the Root CA is kept offline. What is the most appropriate way to sign the Subordinate CA request?
Expose the Root CA via a restricted management port in the firewall.
Configure a secure VPN tunnel between the Subordinate CA and the Root CA to exchange the CSR.
Use an HSM to automatically sign the request from the Subordinate CA.
Transfer the CSR via air-gapped media to the offline Root CA, sign, and return the certificate.
This preserves the integrity of the Root CA by keeping it air-gapped.
An ISSEP is evaluating the security of an API gateway. To implement OAuth 2.0 effectively, which flow should be recommended for a native mobile application?
Authorization Code Flow with PKCE.
PKCE provides the necessary security for public clients like mobile apps.
Client Credentials Flow.
Resource Owner Password Credentials Flow.
Implicit Flow.
A system is being designed to process PII. The requirement is to maintain data sovereignty while utilizing a hybrid cloud model. What architectural strategy best achieves this?
Implement a full database mirror in the cloud without encryption.
Migrate all data to the cloud and rely on the Cloud Service Provider's encryption-at-rest.
Use Cloud HSM to store keys and keep raw PII in an on-premises database.
Keeping the data locally and using cloud keys for processing ensures sovereignty.
Use public cloud object storage and rely on IP whitelisting.
An ISSEP is designing a secure architecture for a cloud environment using NIST SP 800-160. Which architectural pattern should the engineer prioritize to ensure the principle of Least Privilege is enforced at the service-to-service communication layer within a Kubernetes cluster?
Implement Istio with mTLS and AuthorizationPolicies.
Istio provides identity-based security and fine-grained access control at the application layer.
Use the default ClusterRoleBinding for all pods.
Deploy all microservices into a single flat network segment.
Enable Kubernetes NetworkPolicies only at the namespace level.
When applying NIST SP 800-53 controls to a new information system, which step occurs immediately after the 'Categorize' process in the RMF?
Implement security and privacy controls.
Monitor security and privacy controls.
Assess security and privacy controls.
Select security and privacy controls.
Control selection is the direct next step after defining the system impact level.
When configuring AWS Security Groups for a multi-tier application architecture, an engineer must ensure that the web tier only communicates with the application tier on port 8080. Which configuration best adheres to the principle of Defense in Depth?
Set the application tier inbound rule to allow TCP 8080 from 0.0.0.0/0.
Use an IP-based rule in the application tier Security Group referencing the private IP of the web tier instances.
Set the application tier inbound rule to allow TCP 8080 from the specific Security Group ID of the web tier.
Security Group referencing is the most secure and scalable method for inter-tier communication.
Set the application tier inbound rule to allow TCP 8080 from the CIDR block of the VPC.
Want more Security Planning And Engineering practice?
Practice this domainWhen designing a secure system architecture, which TWO of the following are primary considerations for achieving the principle of 'Defense in Depth'?
Applying security controls at multiple architectural layers
Layering is the core concept of defense in depth.
Relying solely on perimeter authentication
Maximizing system throughput by minimizing encryption
Implementing a single high-availability firewall
Ensuring diversity in security technologies and controls
Using diverse controls prevents a single exploit from bypassing all layers.
You are integrating security requirements into the Systems Engineering V-Model. At which stage should the Information Systems Security Engineer (ISSE) define the security functional requirements to ensure traceability to the system architecture?
Requirements Analysis
Requirements analysis is the foundational stage where security constraints and functional needs are mapped to system goals.
Detailed Design
System Integration and Testing
Operational Maintenance
An organization is adopting a DevSecOps model. To ensure security engineering principles are met, which tool should be integrated into the CI/CD pipeline to automate the detection of vulnerabilities in proprietary code during the 'Build' stage?
SAST (Static Application Security Testing)
SAST tools are designed to scan source code during the build process.
DAST (Dynamic Application Security Testing)
IDS (Intrusion Detection System)
SIEM (Security Information and Event Management)
During the 'Engineering Process Integration' phase, an ISSE identifies that the legacy system lacks support for modern TLS 1.3 encryption. What is the most appropriate engineering response?
Forcibly inject TLS 1.3 into the binary
Ignore the finding because it is a legacy system
Document the risk and implement compensating controls
Compensating controls provide necessary security when native support is missing.
Immediately shut down the system
When applying NIST SP 800-160 Systems Security Engineering principles, which THREE activities are critical during the 'System Design' phase to ensure confidentiality and integrity?
Developing incident response plans
Identifying security-relevant system components
Identifying components helps focus security controls where they are most needed.
Specifying security-enforcing interfaces
Interfaces are common attack vectors that require specific design attention.
Performing final penetration testing
Defining system trust boundaries
Trust boundaries are essential to limit the propagation of threats.
When using the STRIDE threat modeling methodology, which security principle does 'Tampering' specifically attempt to violate?
Confidentiality
Integrity
Tampering involves unauthorized modification, violating data integrity.
Availability
Non-repudiation
Want more Systems Security Engineering Foundations practice?
Practice this domainYou are performing a security validation of a Kubernetes cluster using CIS Benchmarks. Which tool should you use to automate the verification of the 'etcd' configuration settings?
Use 'kubectl get pods' to check the etcd pod configuration.
Run 'kube-bench --targets etcd' to perform the automated audit.
kube-bench is designed to run CIS benchmark checks, including specific targets like etcd.
Perform a manual audit using 'etcdctl get --prefix /'.
Use the 'kubectl describe nodes' command to check for node hardening.
When validating the security implementation of a Cisco ASA firewall, which command provides the most accurate verification of the currently applied Access Control List (ACL) to a specific interface?
show run interface
show version
show access-list
This command displays the ACL entries and their hit counts, allowing you to verify traffic filtering.
show interface status
A security engineer is validating the implementation of a TLS 1.3 configuration on an Nginx server. Which configuration directive must be verified to ensure only secure ciphers are used?
ssl_session_cache shared:SSL:10m;
ssl_prefer_server_ciphers on;
ssl_verify_client on;
ssl_protocols TLSv1.3;
Restricting the protocol to TLSv1.3 is the primary way to ensure modern, secure communication.
During a penetration test of a web application, you identify an insecure direct object reference (IDOR). What is the most effective way to verify that your remediation via access control checks is successful?
Review the source code to ensure that the developer used a random UUID instead of sequential integers.
Run a vulnerability scanner to check for OWASP Top 10 compliance.
Execute automated authorization testing using a tool like Burp Suite Intruder to verify that non-authorized users receive a 403 Forbidden response.
Intruder can be configured to iterate through object IDs while authenticated as different users to confirm access control enforcement.
Perform a manual cross-site scripting (XSS) payload injection to confirm input sanitization.
A security engineer is validating an AWS environment using AWS Config. Which action should be taken to ensure continuous compliance monitoring against a custom security policy?
Configure Amazon GuardDuty to alert on unauthorized resource modifications.
Deploy an AWS Config custom rule using an AWS Lambda function to evaluate resource configurations.
Custom rules in AWS Config require a Lambda function to execute the logic for evaluating resource compliance.
Use AWS Trusted Advisor to scan for unencrypted S3 buckets.
Enable AWS CloudTrail to log all API calls and review the logs for policy violations.
You are verifying the implementation of a FIPS 140-2 validated module in an on-premises Linux server. Which command correctly verifies that the cryptographic module is operating in the intended FIPS mode?
Inspect '/etc/fips.conf' for the FIPS_ENABLED=true directive.
Run 'cat /proc/sys/crypto/fips_enabled' and confirm the output is 1.
This kernel parameter directly indicates if the system cryptographic module is currently in FIPS mode.
Check the status using 'systemctl status crypto-policy'.
Execute 'openssl verify -CApath /etc/ssl/certs' to validate certificate chains.
Want more Systems Security Implementation Verification And Validation practice?
Practice this domainThe ISC exam has 200 questions and must be completed in 120 minutes. The passing score is 700/1000.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 5 domains: Risk Management, Secure Operations Change Management And Disposal, Security Planning And Engineering, Systems Security Engineering Foundations, Systems Security Implementation Verification And Validation. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official (ISC)² ISC exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.