Free Information Systems Security Architecture Professional (ISSAP) practice test: 30 questions with answers

IEC 62443 groups assets into security zones and controls traffic that crosses between them through conduits, so one monitored conduit carrying only the needed data is the right design. A flat network, direct controller access, or an assumed isolation that does not exist would all expose the controllers.

The industrial DMZ, often called level 3.5, sits between site operations at level 3 and enterprise systems at level 4, where data can be exchanged safely. The other placements either separate field devices from controllers or put the DMZ outside the enterprise boundary.

In IaaS the customer manages the guest operating system, the applications and their configuration, while the provider secures the facilities, hardware and hypervisor. The other three options are provider responsibilities.

A mantrap admits one person at a time, which stops tailgating at the point of entry. Parking lot cameras, a reporting policy and perimeter guards do not physically prevent a second person from slipping through the data center door.

IEEE 802.1X authenticates a client at a switch or access point port, typically through EAP, before it is allowed onto the network. The other standards aggregate links, tag VLAN traffic, or define wireless transmission, so none of them controls port access.

Endpoint detection and response records process, memory and script behavior and lets analysts trace activity, which is how fileless attacks are found. Full-disk encryption, host firewall rules and software inventory checks do not observe running behavior.

A key that may be exposed must be revoked and replaced, and the data it protected should be re-encrypted under the new key. Changing the schedule, duplicating the key, or continuing to use the compromised key leaves the exposure in place.

An HSM keeps private key material inside tamper-resistant hardware and performs signing there, so a compromised host cannot simply copy the key. Encrypted files, readable configuration files and mailbox copies all place key material where a compromised server or administrator can reach it.

Deprovisioning removes or disables access when a relationship ends, and its failure leaves orphaned contractor accounts. The other options describe creating accounts or the checks that run after access is granted, so they would not explain lingering contractor accounts.

SAML 2.0 exchanges XML assertions signed by an identity provider so that service providers can trust the user's identity for single sign-on. Kerberos uses tickets from a key distribution center, OAuth issues delegated access tokens, and RADIUS encrypts only the password field.

TACACS+ encrypts the whole packet body and separates authentication, authorization and accounting, which suits per-command control of device administration. RADIUS encrypts only the password and merges authentication with authorization, while plain LDAP binds and SAML do not handle device command authorization.

Kerberos tickets carry timestamps, so a large clock skew between the client and the KDC makes ticket validation fail even when the credentials are correct. Certificate trust, one-time codes and salted password storage are not the usual cause of Kerberos ticket failures.

Attribute-based access control makes decisions from attributes of the user, device, resource and context, so it can express the department, device and time conditions together. RBAC keys off roles, DAC leaves decisions to owners, and MAC relies on central labels, so none captures all three conditions directly.

Privileged access management grants elevated rights just in time, removes them when the task ends, and records sessions for accountability. Shared passwords, standing administrator membership and periodic reviews all keep privilege persistent or unrecorded.

Central, access-restricted log storage protects audit records from local tampering, and accurate synchronized time lets investigators correlate events across systems. Allowing edits, logging only failures and keeping logs on the originating host all weaken the audit trail.

OpenID Connect adds an identity layer on top of OAuth 2.0, and OAuth supplies the access token for delegated API calls. SAML is not designed to issue bearer tokens for APIs, Kerberos tickets are not meant for browser-based delegation, and RADIUS accounting records do not establish identity for web applications.

Repudiation is the STRIDE category for a party being able to deny an action when the system cannot prove otherwise, which is what missing tamper-evident records allow. Spoofing concerns false identity, tampering concerns unauthorized changes, and information disclosure concerns exposure of data.

Environmental metrics let an organization modify the score using its own security requirements and the controls it has in place. Base metrics are fixed intrinsic traits, temporal metrics track exploit and fix maturity, and exploitability is a sub-score inside the base group.

SABSA is a business-driven security architecture framework whose layers are traced with a matrix of what, how, where, who, when and why. ITIL covers IT service management, COBIT covers governance objectives, and NIST SP 800-53 is a control catalog, so none of the others is an architecture framework built on that matrix.

The Architecture Development Method is the iterative, phase-based cycle at the core of TOGAF, covering vision, business, information systems, technology, opportunities and migration. The other choices are general management models that are not part of TOGAF.

Compensating controls are alternatives used when the preferred control, here patching, is not possible, and network isolation limits who can reach the vulnerable system. The other options defer the problem, ignore it, or do nothing to reduce exposure.

Static analysis of source code and an architecture review against security requirements both verify the design or implementation before go-live. A scan after release happens too late for pre-deployment assurance, and reading brochures or test restores do not verify security design.

Denial of service is the STRIDE category for threats that block or degrade availability, which is what the request flood does. Spoofing involves a false identity, elevation of privilege involves gaining unauthorized rights, and tampering involves unauthorized modification of data.

A compliance obligations register links each legal, regulatory and contractual requirement to the assets it governs, which is what the lead asked for. The pen test shows technical weaknesses, the continuity plan covers recovery, and the questionnaire covers only one vendor, so none of them provides the full mapping.

A right-to-audit clause gives the customer a contractual basis to assess the provider's controls and request evidence such as independent assurance reports. Liability caps, governing law and exclusivity clauses address money, jurisdiction and business terms rather than verification.

Owners decide classification, access rules and risk acceptance, while custodians, often IT staff, implement and operate the safeguards that enforce those decisions. The other three options describe owner decisions, so the custodian's implementation duty is the one that differs.

Avoidance removes the activity that creates the risk, which is what dropping the feature does. Acceptance keeps the exposure, transfer shifts it to another party, and mitigation reduces it with controls, so those three do not match the decision described.

Annualized loss expectancy equals single loss expectancy multiplied by the annualized rate of occurrence, so 10,000 x 2 = 20,000 USD. The other figures reflect treating one outage as the annual total, halving the frequency, or doubling the frequency to four outages.

Mapping means building an inventory of assets with their dependencies and linking each asset to its accountable stakeholders. Vendor selection, budget approval and policy publication are separate activities that do not belong to the mapping step.

A data protection impact assessment is the privacy review required for high-risk processing such as large-scale profiling, and it evaluates risks to individuals before the processing begins. The vulnerability assessment, capacity plan and penetration test address security or operations, not the privacy risk created by the planned profiling.