How many Select Two (Multi-Select) Questions questions are on this page?

This page has 20 Select Two (Multi-Select) Questions scenario questions for the ISC exam, each with detailed explanations and wrong-answer analysis.

How should I approach ISC scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to (ISC)2 Information Systems Security Architecture Professional (CISSP-ISSAP, Aug 2025 blueprint) (ISC) questions

Scenario-based practice

Select Two (Multi-Select) Questions

Practise (ISC)2 Information Systems Security Architecture Professional (CISSP-ISSAP, Aug 2025 blueprint) (ISC) practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

ISC

exam code

(ISC)²

vendor

Scenario guide

How to approach select two (multi-select) questions

Multi-select questions tell you to 'Choose TWO' or 'Choose THREE'. Getting partial credit is not a thing — you must select all correct answers with no incorrect ones. The stem always states how many to choose, so trust it. These questions require precision, not best-guess elimination.

Quick answer

Select Two (Multi-Select) Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1hardmulti select

Select Two (Multi-Select) Questions

How to approach select two (multi-select) questions

Quick answer

Related ISC topic practice pages

Infrastructure And System Security practice questions

Security Architecture Modeling practice questions

Governance Risk And Compliance practice questions

Identity And Access Management Architecture practice questions

ISC fundamentals practice questions

ISC scenario practice questions

ISC troubleshooting practice questions

Practice scenarios

When designing a secure multi-region cloud architecture, which THREE governance aspects must be clearly defined for data residency compliance?

Which THREE criteria are most important when selecting a Cloud Service Provider (CSP) based on the Shared Responsibility Model for an ISSAP architect?

Which TWO methods are used to prevent 'Token Replay' attacks in an OAuth/OIDC architecture?

A security architect is hardening a Linux-based server environment. Which TWO of the following kernel-level security modules should be configured to enforce mandatory access control?

To implement effective Risk Management integration into architecture using the FAIR (Factor Analysis of Information Risk) framework, which THREE metrics must an architect define for each identified scenario?

When establishing a Third-Party Risk Management (TPRM) process, which THREE factors must be considered during the initial due diligence?

An architect is evaluating compliance for an enterprise multi-cloud environment. Which THREE capabilities must be included in a centralized GRC platform for it to be effective?

Which TWO factors are critical when establishing a Risk Appetite statement for a new cloud-native architecture?

Which TWO risks are significantly mitigated by implementing a Privileged Access Management (PAM) vault?

Which TWO actions should be taken when integrating a new cloud service into an existing GRC program?

Which THREE of the following are risks associated with using shared cloud storage buckets?

Which THREE types of claims are typically included in a JSON Web Token (JWT)?

Which TWO factors are mandatory for a secure 'MFA' implementation?

When designing an architecture for GDPR compliance, which THREE technical controls should be prioritized to satisfy the 'Right to be Forgotten' requirement?

Which THREE attributes should be evaluated when defining access policies in a modern Zero Trust Architecture?

Which TWO of the following are essential for protecting against SQL Injection?

Which THREE features are essential for a robust Privileged Access Management (PAM) architecture that adheres to the principle of least privilege?

Which THREE mechanisms are commonly used to secure the 'Authorization Code' in an OAuth 2.0 flow?

Which THREE of the following are common network security architecture tools?

Which TWO concepts are central to 'Federated Identity'?