Information Systems Security Architecture Professional (ISSAP)

Last checked November 10, 2026 against the official ISC2 exam page.

1. Question 1Infrastructure and System Security

   A water utility wants its business reporting network to receive historian data from the process control network. Several controllers cannot be patched. Under IEC 62443 zone and conduit thinking, which design is most appropriate?

   1. AAn assumption that the process network is isolated, so the link between them needs no monitoring
   2. BA flat layer 2 switch that connects both networks so every host can reach historian data
   3. CDirect read access for the reporting team to the controllers so that the data stays current
   4. DSeparate zones joined by one monitored conduit that carries only the historian traffic
   Show answer and explanationHide answer

   Correct answer: D

   IEC 62443 groups assets into security zones and controls traffic that crosses between them through conduits, so one monitored conduit carrying only the needed data is the right design. A flat network, direct controller access, or an assumed isolation that does not exist would all expose the controllers.

2. Question 2Identity and Access Management (IAM) Architecture

   An audit finds dozens of active accounts belonging to contractors whose engagements ended months ago. Which identity lifecycle phase was not carried out correctly?

   1. AProvisioning, which creates accounts and initial access when a new worker first joins
   2. BDeprovisioning, which removes or disables access when a working relationship ends
   3. CAuthentication, which verifies the identity of a user each time that user signs in
   4. DAuthorization, which decides which resources an authenticated user may reach afterward
   Show answer and explanationHide answer

   Correct answer: B

   Deprovisioning removes or disables access when a relationship ends, and its failure leaves orphaned contractor accounts. The other options describe creating accounts or the checks that run after access is granted, so they would not explain lingering contractor accounts.

3. Question 3Security Architecture Modeling

   During threat modeling for a payment API, the team notes that a customer could submit a transaction and later credibly deny having done so, because no tamper-evident audit record ties the action to the account. Which STRIDE category describes this threat?

   1. ASpoofing
   2. BTampering
   3. CRepudiation
   4. DInformation disclosure
   Show answer and explanationHide answer

   Correct answer: C

   Repudiation is the STRIDE category for a party being able to deny an action when the system cannot prove otherwise, which is what missing tamper-evident records allow. Spoofing concerns false identity, tampering concerns unauthorized changes, and information disclosure concerns exposure of data.

4. Question 4Governance, Risk, and Compliance (GRC)

   A regional clinic stores patient records and also accepts card payments from patients. Its compliance lead wants one document that lists each legal, regulatory and contractual obligation along with the systems and datasets it applies to. Which artifact fits this need?

   1. AA business continuity plan that sets recovery priorities for each clinical application
   2. BA penetration test report that lists every exploitable weakness found across the clinic's network and cloud accounts
   3. CA compliance obligations register that maps each requirement to the systems and data it covers
   4. DA vendor security questionnaire that the card processor completed during onboarding
   Show answer and explanationHide answer

   Correct answer: C

   A compliance obligations register links each legal, regulatory and contractual requirement to the assets it governs, which is what the lead asked for. The pen test shows technical weaknesses, the continuity plan covers recovery, and the questionnaire covers only one vendor, so none of them provides the full mapping.

5. Question 5Infrastructure and System Security

   In the Purdue reference model for industrial control systems, where is the industrial demilitarized zone typically placed?

   1. ABetween the field device level and the basic control level
   2. BBetween the site operations level and the enterprise business level
   3. CAbove the enterprise level, outside the corporate firewall boundary
   4. DInside the supervisory control level, alongside the operator HMI servers
   Show answer and explanationHide answer

   Correct answer: B

   The industrial DMZ, often called level 3.5, sits between site operations at level 3 and enterprise systems at level 4, where data can be exchanged safely. The other placements either separate field devices from controllers or put the DMZ outside the enterprise boundary.