Free ISSEP Exam Practice Questions

Sample Practice Questions

Try these 10 sample questions from the ISSEP Exam practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1A supplier's component is relied on because no alternative is available, but its security claims have not been substantiated. Which assessment distinguishes trust from trustworthiness?

   1. A. Reliance demonstrates trustworthiness even when supporting evidence is unavailable.
   2. B. Reliance reflects trust, while trustworthiness requires evidence supporting the claims.
   3. C. Reliance establishes assurance because the available alternatives have been considered.
   4. D. Reliance removes the need to evaluate whether the expected behavior will occur.

   Answer: B

   Explanation: "A trustworthy entity requires sufficient evidence to support its trustworthiness claims." Reliance alone expresses a belief; the missing evidence prevents that reliance from substantiating trustworthiness. Lack of an alternative does not establish assurance or eliminate evaluation.

   Reference: Engineering Trustworthy Secure Systems (NIST SP 800-160 Vol. 1 Rev. 1) — Appendix F.1, p. 102

2. 2How should an organization's information security risk management program relate to enterprise risk management?

   1. A. Replace the enterprise process with a technology-focused assessment process.
   2. B. Remain separate so security decisions need not consider other enterprise risks.
   3. C. Complement the broader enterprise risk management program.
   4. D. Limit the enterprise program to risks that have technical security controls.

   Answer: C

   Explanation: "the risk management guidance described herein is complementary to and should be used as part of a more comprehensive Enterprise Risk Management (ERM) program." Security risk decisions form part of enterprise risk management. They neither replace the broader program nor justify isolating security from other business risks.

   Reference: Managing Information Security Risk: Organization, Mission, and Information System View (NIST SP 800-39) — Section 1.1, p. 3

3. 3During stakeholder interviews, several operational users cannot initially articulate their security concerns. How should the requirements team treat those concerns?

   1. A. Record no security needs for those users unless they submit formal requirements.
   2. B. Use discussion to make implicit concerns explicit before defining protection needs.
   3. C. Replace the users' concerns with the supplier's standard control checklist.
   4. D. Wait until acceptance testing to ask users what protection they expected.

   Answer: B

   Explanation: "Some concerns are explicitly known and can be stated; others are initially implicit, not necessarily known, and must be made explicit through discourse." Elicitation must uncover implicit needs. Silence does not establish that no needs exist, and supplier defaults or late testing cannot replace that discussion.

   Reference: Engineering Trustworthy Secure Systems (NIST SP 800-160 Vol. 1 Rev. 1) — Appendix H.2.3, SN-1.1 Note 1, p. 118

4. 4A previously used component is selected for a new system purpose. What security consideration belongs in its implementation strategy?

   1. A. Accept its previous approval as sufficient for any new operational purpose.
   2. B. Assess the extent, source, suitability, and trustworthiness of the proposed reuse.
   3. C. Limit review to whether the component fits the new system's physical interfaces.
   4. D. Treat reuse as exempt from the constraints applied to newly acquired elements.

   Answer: B

   Explanation: "source, suitability, and trustworthiness of the reused system elements for the new purpose." Reuse must be assessed for the new purpose. Prior approval, physical fit alone, and a reuse exemption do not establish the required suitability and trustworthiness.

   Reference: Engineering Trustworthy Secure Systems (NIST SP 800-160 Vol. 1 Rev. 1) — Appendix H.7.3, IP-1.1 Note 1, pp. 129–130

5. 5What should drive security training and qualification requirements in a secure operations plan?

   1. A. The number of years each employee has held any technical job
   2. B. A generic job title without assessment of role-specific proficiency
   3. C. The roles and functions needed to operate securely in the system's defined modes
   4. D. Training for a different system with different operating modes

   Answer: C

   Explanation: "Security qualification and training includes role and function-oriented competency, proficiency, certification, and other criteria to securely operate and use the system in all of its defined modes or states." Qualifications should demonstrate competence for the actual roles, functions, and operating modes. General tenure, titles, and another system's training do not themselves establish it.

   Reference: Engineering Trustworthy Secure Systems (NIST SP 800-160 Vol. 1 Rev. 1) — Appendix H.12.3, OP-1.6 Note, p. 141

6. 6How should systems security engineering relate to the broader systems engineering effort?

   1. A. It should approve the completed system after the engineering disciplines finish their work.
   2. B. It should maintain a separate development lifecycle that supplies controls at deployment.
   3. C. It should replace the other engineering disciplines when the system has security objectives.
   4. D. It should operate as an integrated subdiscipline throughout realization, use, and retirement.

   Answer: D

   Explanation: "As a subdiscipline of systems engineering, systems security engineering is a transdisciplinary and integrative approach to enabling the successful realization, use, and retirement of engineered trustworthy secure systems." Security engineering is integrated with the system effort across its life, rather than being a separate approval stage, a late control overlay, or a replacement for other disciplines.

   Reference: Engineering Trustworthy Secure Systems (NIST SP 800-160 Vol. 1 Rev. 1) — p. 29 / Systems Security Engineering

7. 7An organization is prioritizing mission processes and embedding security requirements into its enterprise architecture. At which level does this work principally occur in NIST's three-tier risk model?

   1. A. Tier 2, the mission/business process level
   2. B. Tier 1, the organization-wide strategic level
   3. C. Tier 3, the individual information-system level
   4. D. Across independent system authorizations without a mission-process level

   Answer: A

   Explanation: "Tier 2 addresses risk from a mission/business process perspective" Tier 2 translates organization-level direction into mission processes and architecture. Tier 1 sets strategic context, while Tier 3 implements system-level decisions; independent authorizations do not replace Tier 2.

   Reference: Managing Information Security Risk: Organization, Mission, and Information System View (NIST SP 800-39) — Section 2.2, pp. 9–10

8. 8Why should regulatory, authorization, certification, and acceptance representatives be identified as security-relevant stakeholders?

   1. A. They replace operational stakeholders in deciding which user capabilities the system should deliver.
   2. B. They take over the development team's responsibility for implementing the system's security mechanisms.
   3. C. They make supplier documentation sufficient evidence for every later system acceptance decision.
   4. D. They hold security-relevant decision authority that must be represented when requirements are established.

   Answer: D

   Explanation: "This includes stakeholders who represent milestone decision authority, regulatory, certification, authorization, acceptance, and similar organizations with specific security-relevant decision-making authority and responsibilities." These representatives have specific security-relevant decision authorities and responsibilities. Their participation does not replace operational needs elicitation, transfer implementation responsibility, or make supplier documentation automatically sufficient for acceptance.

   Reference: Engineering Trustworthy Secure Systems (NIST SP 800-160 Vol. 1 Rev. 1) — Appendix H.2.3, SN-1.1 Note 2, p. 118

9. 9How should firmware be treated when implementing security into a system element?

   1. A. Apply hardware considerations alone because the delivered object has a physical form.
   2. B. Apply software considerations alone because firmware contains executable instructions.
   3. C. Exclude firmware from implementation review when its source code is unavailable.
   4. D. Address both hardware and software security implementation considerations.

   Answer: D

   Explanation: "Firmware elements, therefore, adhere to the security implementation considerations of both hardware and software elements." Firmware combines software behavior with physical realization. Emphasizing only one aspect or excluding opaque firmware omits relevant implementation concerns.

   Reference: Engineering Trustworthy Secure Systems (NIST SP 800-160 Vol. 1 Rev. 1) — Appendix H.7.3, IP-2.1 / Firmware, p. 130

10. 10An incident response plan assigns a contractor responsibility for certain operational response actions. What should accompany that assignment?

    1. A. The authority necessary to carry out the assigned incident response responsibilities
    2. B. Automatic authority to make every organization-wide risk acceptance decision
    3. C. Permission to define incident duties without the organization's documented policies
    4. D. A requirement to obtain a new contract before performing any assigned action

    Answer: A

    Explanation: "All appropriate individuals or parties should be designated the authority necessary to fulfill their incident responserelated responsibilities." Responsibility should be matched with the necessary authority. That does not imply unlimited risk acceptance powers, undocumented duties, or a new contract for actions already assigned.

    Reference: Incident Response Recommendations and Considerations for Cybersecurity Risk Management (NIST SP 800-61 Rev. 3) — Table 2, GV.RR-02, R2