Free Information Systems Security Architecture Professional (ISSAP) Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Information Systems Security Architecture Professional (ISSAP) practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1A HIPAA-covered hospital is identifying the information to which the Security Rule applies. Which category falls within that rule's protected-information scope?

   1. A. All patient information, regardless of its medium
   2. B. Protected health information maintained or transmitted electronically
   3. C. Only electronic records submitted in insurance claims
   4. D. Only medical records stored on hospital-owned servers

   Answer: B

   Explanation: HHS states: "the Security Rule does not apply to PHI that is maintained or transmitted on paper or verbally." Its scope is ePHI, including electronic information beyond claims and beyond hospital-owned servers. Other HIPAA rules can protect information in other media.

   Reference: Summary of the HIPAA Security Rule — What Information is Protected

2. 2What is the defining orientation of the SABSA methodology when selecting an enterprise security architecture approach?

   1. A. Selecting security products before establishing business objectives
   2. B. Deriving security architecture from business objectives, risks, and opportunities
   3. C. Limiting architecture analysis to network device configurations
   4. D. Treating regulatory checklists as a substitute for business requirements

   Answer: B

   Explanation: The SABSA Institute calls its methodology "risk and opportunity focused" and describes it as driven by business needs with traceability to business objectives. This supports deriving security architecture from business objectives and risk context. Product-first selection, configuration-only analysis, and replacing business requirements with a regulatory checklist do not express that orientation.

   Reference: SABSA Executive Summary — What is SABSA?, opening paragraph

3. 3A deployment combines a private cloud and a public cloud. They remain distinct but are connected by technology that enables application and data portability. Which NIST cloud deployment model describes this arrangement?

   1. A. Community cloud
   2. B. Public cloud
   3. C. Private cloud
   4. D. Hybrid cloud

   Answer: D

   Explanation: NIST defines hybrid cloud as "a composition of two or more distinct cloud infrastructures". The infrastructures remain unique and technology enables portability between them. Public, private, and community each describe an individual deployment model rather than this composition.

   Reference: The NIST Definition of Cloud Computing — Section 2, Deployment Models — Hybrid cloud, p.3

4. 4During identity proofing, what is the purpose of identity resolution under NIST SP 800-63A-4?

   1. A. Determine that the claimed identity corresponds to a unique individual in the served population
   2. B. Confirm that the presented evidence's security features are authentic and unaltered
   3. C. Confirm that the applicant is the rightful owner of the presented identity evidence
   4. D. Bind authenticators to a subscriber account after successful proofing

   Answer: A

   Explanation: NIST describes resolution as: "Determine that the claimed identity corresponds to a single, unique individual within the context of the population of users served by the CSP or online service." Authenticating evidence, linking it to its owner, and binding authenticators serve different parts of the identity lifecycle.

   Reference: Digital Identity Guidelines: Identity Proofing and Enrollment — Introduction — Expected Outcomes of Identity Proofing — Identity resolution

5. 5A covered entity plans to permit a business associate to maintain ePHI on its behalf. What must be in place before that access is permitted under the HIPAA Security Rule?

   1. A. A supplier's promise to negotiate safeguards after deployment
   2. B. A general nondisclosure agreement covering confidentiality alone
   3. C. A completed supplier security self-assessment questionnaire
   4. D. A compliant business associate agreement or other written arrangement

   Answer: D

   Explanation: HHS states: "Before permitting a business associate to create, receive, maintain, or transmit ePHI, a regulated entity must have in place a contract or other written arrangement". The arrangement must meet the business associate requirements. A promise to negotiate later is late; a confidentiality-only NDA lacks the required safeguard commitments; a security questionnaire does not establish the qualifying agreement.

   Reference: Summary of the HIPAA Security Rule — Administrative Safeguards — Business Associate Contracts and Other Arrangements

6. 6In SABSA's integrated frameworks, Attributes Profiling is the name used for which framework?

   1. A. The Business Requirements Engineering Framework
   2. B. The Security Services-Oriented Architecture Framework
   3. C. The Policy Architecture Framework
   4. D. The Governance Framework

   Answer: A

   Explanation: The official list identifies "Business Requirements Engineering Framework (known as Attributes Profiling)". Attributes Profiling belongs to business requirements engineering; policy architecture, service architecture, and governance are other named frameworks in the same methodology.

   Reference: SABSA Executive Summary — What is SABSA?, integrated frameworks list

7. 7An organization requires a cloud infrastructure for its exclusive use, but permits a third party to operate it off premises. Which NIST deployment model can satisfy the exclusivity requirement?

   1. A. Public cloud
   2. B. Private cloud
   3. C. Community cloud shared by unrelated organizations
   4. D. Hybrid cloud solely because the operator is a third party

   Answer: B

   Explanation: NIST states: "The cloud infrastructure is provisioned for exclusive use by a single organization". A private cloud may be third-party operated and off premises. Public use, sharing among a community of organizations, and the operator's identity do not meet or define this exclusivity requirement.

   Reference: The NIST Definition of Cloud Computing — Section 2, Deployment Models — Private cloud, p.3

8. 8A proofing service checks an identity document's security features to determine whether it is forged or altered. Which proofing outcome is this check primarily supporting?

   1. A. Identity resolution
   2. B. Identity enrollment
   3. C. Evidence validation
   4. D. Authenticator binding

   Answer: C

   Explanation: NIST defines evidence validation as: "Confirm that supplied identity evidence is genuine, authentic, and accurate." Checking for forgery or alteration concerns the evidence itself. Uniqueness, enrollment, and binding an authenticator do not perform that authenticity check.

   Reference: Digital Identity Guidelines: Identity Proofing and Enrollment — Introduction — Expected Outcomes of Identity Proofing — Evidence validation

9. 9An architect discovers that a HIPAA Security Rule implementation specification is designated addressable. How should the architect interpret that designation?

   1. A. Assess whether it is reasonable and appropriate, and justify any appropriate alternative
   2. B. Treat it as optional whenever the implementation would increase operating costs
   3. C. Implement it unchanged because alternatives are unavailable for addressable specifications
   4. D. Apply it only after a security incident demonstrates that the safeguard was needed

   Answer: A

   Explanation: HHS explains: "Rather, it permits regulated entities to determine whether the addressable implementation specification is reasonable and appropriate for that regulated entity." Addressable specifications are not simply optional. Adopt the specification when reasonable and appropriate; if not, document why and adopt a reasonable and appropriate alternative that achieves the standard when applicable. Cost alone does not remove the obligation.

   Reference: Summary of the HIPAA Security Rule — Required and Addressable Implementation Specifications

10. 10An attacker signs in to a service using credentials stolen from a legitimate user. Which STRIDE category most directly describes the identity threat?

    1. A. Repudiation
    2. B. Denial of service
    3. C. Tampering
    4. D. Spoofing

    Answer: D

    Explanation: Microsoft describes spoofing as involving "using another user's authentication information". The attacker is impersonating another identity. Repudiation concerns denial of actions, denial of service concerns availability, and tampering concerns unauthorized modification of data.

    Reference: Microsoft Threat Modeling Tool threats — STRIDE model — Spoofing row