(ISC)2 Information Systems Security Architecture Professional (CISSP-ISSAP, Aug 2025 blueprint) ISC practice test

Which THREE of the following are valid security controls for a database?

Which TWO of the following are primary goals of conducting threat modeling during the architecture phase? (Select TWO)

Which threat modeling technique is best described as focusing on the attacker's perspective and their motivation?

Which TWO are common challenges in Enterprise Security Architecture? (Select TWO)

In a SAML 2.0 federation, an Identity Provider (IdP) is failing to authenticate users because the Service Provider (SP) cannot verify the assertion integrity. The SP requires the I…

When designing a secure network, which zone should host public-facing services to minimize the risk of lateral movement to internal networks?

When using an API Gateway as a Policy Enforcement Point (PEP), where should the authorization decision logic be offloaded to ensure central governance?

A security engineer needs to secure SSH access to Linux servers in a cloud VPC. What is the most secure method to replace static SSH keys?

You are designing a VPC architecture in AWS. You need to ensure that database instances in a private subnet can download patches from the internet without being directly reachable…

Which TWO of the following are key benefits of 'Immutable Infrastructure'?

What is the primary purpose of an 'Architecture Trade-off Analysis Method' (ATAM)?

Which THREE of the following are primary components of a typical Cisco ACI (Application Centric Infrastructure) fabric design used to enforce security segmentation?

You are designing a Zero Trust architecture in AWS. You need to implement micro-segmentation for a set of EC2 instances running a web application. Which AWS feature provides the mo…

Which TWO types of documentation are standard in the SABSA methodology? (Select TWO)

When designing a secure multi-region cloud architecture, which THREE governance aspects must be clearly defined for data residency compliance?

An organization requires that all cloud storage assets are encrypted using customer-managed keys. Which service should the architect configure to track the key usage and verify com…

What is the purpose of 'Claims Transformation' in an Identity Provider?

What is the primary architectural purpose of implementing Just-in-Time (JIT) access?

Which component is the most critical to protect in a web-based architecture?

An architect is evaluating compliance for an enterprise multi-cloud environment. Which THREE capabilities must be included in a centralized GRC platform for it to be effective?

You are reviewing the security architecture of a Kubernetes cluster. Which TWO of the following configurations are considered best practices for preventing unauthorized container p…

Which risk management framework is most commonly used for aligning business objectives with IT capabilities in large enterprises?

Which security principle is enforced when you restrict an application's ability to modify system files?

You are auditing a GCP environment. You discover that a Cloud Function is accessing a Cloud Storage bucket using the default Compute Engine service account. What is the primary sec…