Reinforce ISC concepts with active-recall study cards covering all 5 blueprint domains. Each card shows the question on the front and the correct answer with a full explanation on the back.
Flashcards work through active recall — the process of retrieving information from memory rather than passively re-reading it. Research consistently shows that active recall produces stronger, longer-lasting memory than re-reading study guides. For ISC preparation, this means flashcards are one of the highest-return study tools available.
Attempt recall first
Read the ISC question on each card, pause, and attempt to formulate the answer in your own words before revealing. This retrieval attempt — even if wrong — dramatically strengthens memory compared to immediately reading the answer.
Review wrong cards again
When you get a card wrong, note it and add it back to your review pile. Spaced repetition — seeing difficult cards more frequently — is the mechanism that makes flashcard study far more efficient than linear reading.
Study by domain
Group your ISC flashcard sessions by domain for the first 3–4 weeks. Master one domain before moving to the next. In the final week, shuffle all cards together to test cross-domain recall — which is what the real ISC exam requires.
Short sessions beat marathon reviews
20–30 flashcard cards per session, done daily, produces better retention than a single 200-card marathon session. Five short daily sessions per week over 4 weeks gives you over 400 total card reviews — enough to reliably pass ISC.
Sample cards from the ISC flashcard bank. Read the question, think of the answer, then read the explanation below.
During the design of a PKI hierarchy for a highly classified system, the ISSEP needs to ensure that the Root CA is kept offline. What is the most appropriate way to sign the Subordinate CA request?
Transfer the CSR via air-gapped media to the offline Root CA, sign, and return the certificate.
To maintain an offline Root CA, the CSR from the Subordinate CA must be transferred via secure, out-of-band medium to the offline environment, signed, and the resulting certificate returned.
An administrator needs to wipe a decommissioned laptop hard drive. Which method meets the NIST 800-88 'Purge' standard for magnetic media?
Degaussing
Degaussing is the only method listed that specifically aligns with the Purge standard for magnetic media by exposing the drive to a strong magnetic field.
An ISSEP is conducting a quantitative risk assessment for a mission-critical database. The Annualized Rate of Occurrence (ARO) is 0.5, and the Single Loss Expectancy (SLE) is $100,000. What is the Annualized Loss Expectancy (ALE)?
$50,000
The ALE is calculated by multiplying the SLE by the ARO (100,000 * 0.5 = 50,000).
You are performing a security validation of a Kubernetes cluster using CIS Benchmarks. Which tool should you use to automate the verification of the 'etcd' configuration settings?
Run 'kube-bench --targets etcd' to perform the automated audit.
kube-bench is the CIS-certified tool that automates Kubernetes CIS Benchmark checks, and its --targets etcd flag runs only the etcd-specific controls (e.g., ensuring etcd data dir permissions, peer/client cert authentication, and encryption at rest). It reads the etcd manifest and configuration files directly on the control plane node to produce pass/fail results mapped to CIS control IDs. This is the standard automated audit method for etcd hardening.
You are integrating security requirements into the Systems Engineering V-Model. At which stage should the Information Systems Security Engineer (ISSE) define the security functional requirements to ensure traceability to the system architecture?
Requirements Analysis
In the Systems Engineering V-Model, the left side represents decomposition and definition phases. Requirements Analysis is the stage where stakeholder needs are translated into system-level requirements, including security functional requirements. Defining security requirements here ensures they are allocated to the system architecture and can be traced through design, implementation, and testing. This early definition is critical for traceability and for avoiding costly rework later.
An ISSEP is reviewing the security architecture for a system that handles PII. The system uses a centralized database for PII storage. What is the primary risk associated with this design pattern?
Increased risk of data exposure through a single point of compromise.
A centralized PII database creates a single aggregation point: one successful compromise (SQL injection, credential theft, misconfigured access) exposes the entire PII dataset at once. This violates the principle of minimizing blast radius and is the primary architectural risk, which is why regulations like GDPR and CCPA push for data minimization, segmentation, and encryption. The other options describe operational concerns, not the core security risk of centralization.
An ISSE is reviewing the change management process for a system that processes law enforcement sensitive data. A proposed emergency change will modify the audit logging configuration to reduce log volume during a peak period. The change must be implemented within four hours. Which action best preserves the security posture while meeting the timeline?
Implement the change under emergency change procedures with the security impact documented and a post-implementation review scheduled.
An emergency change to audit logging must proceed quickly but cannot bypass accountability. Using the emergency change procedure with documented security impact and a scheduled post-implementation review lets the change take effect within the four-hour window while ensuring the reduced logging is evaluated, compensated, and formally accepted or rolled back.
Which of the following is a primary objective of a 'System-Level Risk Assessment'?
To determine the risk level and prioritize the implementation of security controls.
The primary objective is to identify and document the risks to a specific system, helping stakeholders make informed decisions about risk acceptance and mitigation.
What is the primary risk of a 'Privileged User' who lacks proper oversight?
They can bypass security controls and abuse access
Privileged users have significant access, so without oversight (separation of duties/auditing), they can perform malicious actions or make catastrophic errors.
A security engineer is validating that a new VPN concentrator correctly enforces the organization's remote access policy. The policy states that only members of the 'Remote Users' group may connect, that split tunneling is prohibited, and that all sessions must use AES-256 encryption. After configuring the device, the engineer needs to verify enforcement. Which action best validates that the policy is enforced as intended?
Connect as an authorized user, inspect the assigned routes and the negotiated cipher, and confirm no local network access is permitted.
Validating policy enforcement requires observing real session behavior against each requirement. Establishing an authorized session and inspecting the routes, negotiated cipher, and local network reachability confirms group enforcement, absence of split tunneling, and AES-256 encryption simultaneously. Configuration review, authentication logs, and a single negative test each cover only part of the policy and cannot demonstrate full enforcement.
An ISSEP is performing a risk assessment for a system that uses a common biometric authentication mechanism. The system owner wants to understand the risk of a false acceptance. Which metric should the ISSEP use to quantify this risk?
False Acceptance Rate (FAR)
The risk of an unauthorized individual being granted access is quantified by the False Acceptance Rate (FAR). FAR directly measures the likelihood of a biometric false positive, which is a security concern. The ISSEP should use FAR to assess the risk and then determine if additional controls are needed. Other metrics like FRR and EER address different aspects and do not isolate the false acceptance risk.
An ISSEP is preparing the security engineering documentation for a new Department of Defense (DoD) information system that will process classified data. The program manager wants to know which document formally captures the security controls, their implementation details, and the system's authorization boundary, and is required to accompany the system through the Risk Management Framework (RMF) authorization process. Which document should the ISSEP identify?
System Security Plan (SSP)
The System Security Plan is the RMF artifact that describes the system's authorization boundary, the selected security controls, and how each control is implemented. It accompanies the system through assessment and authorization and is the foundational document the Authorizing Official reviews. The SAR, POA&M, and ATO each serve distinct roles later in the process but do not substitute for the SSP.
When validating a server's compliance with hardening guidelines, which tool provides the most efficient way to check OS configuration against the DISA STIG?
SCAP Compliance Checker (SCC)
SCAP Compliance Checker (SCC) is specifically designed to automate the assessment of systems against Security Content Automation Protocol (SCAP) benchmarks, including DISA STIGs. It efficiently scans OS configurations, compares them to the STIG requirements, and generates detailed compliance reports. Unlike general-purpose tools, SCC directly consumes SCAP content, which is the standardized format for expressing STIG rules, making it the most efficient and accurate tool for this task.
When managing a security-sensitive change in a regulated environment, why is 'Separation of Duties' applied to the 'Build' and 'Deploy' roles?
To prevent unauthorized code injection
Separation of duties prevents a single individual from introducing malicious code and deploying it into production, a critical control for integrity.
An organization uses an HSM to store root CA keys. As part of the annual validation, which action must be performed to confirm the HSM's physical security posture?
Verify the presence and integrity of tamper-evident seals on the chassis.
Physical tamper evidence is a critical component of HSM security validation.
An ISSEP is supporting a system that processes classified intelligence data and must be accredited under an Authority to Operate. The system owner proposes to accept a moderate risk involving unencrypted backup tapes stored in a commercial offsite facility, arguing that physical access controls at the facility are adequate. Which action should the ISSEP take?
Escalate the finding to the Authorizing Official with an assessment of the risk and recommended alternatives, since risk acceptance authority rests with that official.
Accepting risk to an accredited system is the Authorizing Official's prerogative. The ISSEP's proper contribution is a clear risk analysis and escalation with alternatives, preserving both the technical record and the formal accountability chain. Unilateral action or informal acceptance would bypass the authorization framework that governs classified systems.
An ISSEP is tasked with securing an internal web application. Which headers should be implemented to prevent clickjacking?
X-Frame-Options: DENY or SAMEORIGIN.
The X-Frame-Options or Content-Security-Policy (CSP) with 'frame-ancestors' are the standard headers used to prevent clickjacking.
An ISSEP is reviewing the risk management plan for a system that has just completed its initial authorization. The system owner asks what activities are required to maintain the authorization over time. Which activity is the PRIMARY focus of continuous monitoring under the Risk Management Framework (RMF)?
Continuously monitoring security controls, assessing changes, and reporting the security posture to the Authorizing Official.
Continuous monitoring under RMF is an ongoing process of monitoring security controls, assessing changes, and reporting the security posture to the Authorizing Official. This enables timely risk-based decisions and maintains the authorization. Periodic activities like full assessments or penetration tests are supporting elements, not the primary focus.
During a system engineering project, an ISSEP discovers that a vendor-provided API lacks robust authentication. Which risk management strategy is best suited for this vulnerability when the API cannot be updated by the development team?
Encapsulate the API behind an authenticated API gateway that enforces OAuth 2.0.
In engineering, when a component is inherently vulnerable, compensating controls like API gateways that perform authentication and authorization can effectively mitigate the risk without modifying the legacy component.
An ISSEP is tasked with ensuring that a new information system complies with the organization's security requirements. The system will be deployed in a cloud environment and will process sensitive but unclassified data. The ISSEP must select an appropriate set of security controls and tailor them to the cloud deployment. Which NIST publication provides the security control catalog and guidance for tailoring controls?
NIST SP 800-53
NIST SP 800-53 is the authoritative catalog of security and privacy controls, and it includes detailed guidance on tailoring controls to specific environments, including cloud deployments. It allows the ISSEP to select controls based on the system's categorization and apply scoping and parameterization. Other publications like SP 800-37 describe the RMF process but do not contain the control catalog itself.
An ISSEP is performing a supply chain risk assessment for an IOT-based sensor array. Which finding poses the highest systemic risk to the overall system integrity?
The sensor firmware is not signed.
Supply chain integrity is compromised when the provenance of hardware or software cannot be verified, as this allows for the insertion of hardware Trojans or backdoors that bypass traditional security controls.
An ISSEP is configuring a WAF to mitigate OWASP Top 10 risks. Which configuration best addresses the 'Injection' category?
Enable 'SQL Injection' and 'Cross-Site Scripting' inspection in the WAF policy.
Configuring specific SQL Injection (SQLi) and Cross-Site Scripting (XSS) rules that inspect request bodies and query parameters is the primary method for blocking injection attacks at the WAF.
The ISC flashcard bank covers all 5 official blueprint domains published by (ISC)². Cards are distributed proportionally, so domains with higher exam weight have more cards.
Domain Coverage
Security Planning And Engineering
Secure Operations Change Management And Disposal
Risk Management
Systems Security Implementation Verification And Validation
Systems Security Engineering Foundations
Both flashcards and practice questions are evidence-based study tools. The difference is in what they train:
Flashcards — concept retention
Best for memorising definitions, acronyms, protocol behaviours, command syntax, and conceptual distinctions. Use flashcards to build the foundational vocabulary that ISC questions assume you know.
Best in: weeks 1–3
Practice tests — application
Best for applying concepts to realistic scenarios, eliminating distractors, and building exam stamina.ISC questions test scenario reasoning — not just recall — so practice tests are essential.
Best in: weeks 3–6
The most effective ISC study plan combines both: use flashcards for the first 2–3 weeks to build conceptual foundations, then shift to practice tests and mock exams in the final 2–3 weeks to apply and benchmark that knowledge. Most candidates who pass on their first attempt use both tools.
Yes. Courseiva provides free ISC flashcards across all official exam domains. Every card includes the correct answer and a full explanation of why it is right and why the distractors are wrong. The platform also includes topic-based practice, mock exams, and readiness tracking — no account required.
Courseiva has 332+ original ISC flashcards across all 5 exam blueprint domains. New cards are added regularly as the question bank grows. All cards are checked against the official (ISC)² exam objectives, with editorial oversight from an experienced network and security engineer.
Courseiva flashcards are purpose-built for IT certification exams. Unlike generic flashcard platforms where content quality varies, every Courseiva card is mapped to the official ISC exam blueprint, written by engineers who hold the certification, and includes a full explanation of the correct answer and why the distractors are wrong. This explanation quality is what separates genuine learning from rote memorisation.
Courseiva is a web platform — an internet connection is required. For offline study, we recommend creating free Courseiva account, using the platform in your browser, and using your device's offline capabilities if your browser supports offline web apps.
Save your results, see which domains need more work, and get spaced repetition recommendations — all free.
Sign Up FreeFree forever · Every certification included