Information Systems Security Engineering Professional (ISSEP)

Last checked November 10, 2026 against the official ISC2 exam page.

1. Question 1Systems Security Engineering Foundations

   An engineering team is redesigning an internal application so that a request from a server on the corporate network is no longer accepted without verification just because it originates inside the network. Which trust model is the team applying?

   1. AZero trust, where every request is continuously verified and authorized regardless of its network location
   2. BPerimeter-based trust, where traffic from inside the corporate network is assumed safe and allowed through
   3. CImplicit trust, where a successful login at the edge firewall grants access to all internal resources
   4. DLeast common mechanism, where all users share one authentication service to simplify access checks
   Show answer and explanationHide answer

   Correct answer: A

   Zero trust removes implicit trust based on network location, so each request is authenticated, authorized, and evaluated continuously. Perimeter-based and implicit trust both assume internal traffic is safe once it passes a boundary, and least common mechanism is a design principle about minimizing shared mechanisms rather than a trust model.

2. Question 2Security Planning and Engineering

   A developer asks for administrative rights on a production database so they can troubleshoot a fault. The security team wants to minimize standing exposure. Which approach best applies least privilege?

   1. AGive the developer the shared administrator account that the operations team already uses for maintenance
   2. BAdd the developer to the database administrators group so future troubleshooting requests are handled faster
   3. CGrant time-limited, scoped access for the specific troubleshooting task, then revoke it when the task ends
   4. DApprove full access because the developer is already trusted and works on the internal network
   Show answer and explanationHide answer

   Correct answer: C

   Least privilege grants only the access needed for the task and only for as long as it is needed. Permanent group membership, a shared account, and full access based on network location all grant more than the task requires.

3. Question 3Risk Management

   A chief risk officer asks the security team to express system-level risks using the same likelihood and impact scales as the enterprise risk register, so leadership can compare them across the organization. What does this request describe?

   1. AReplacing the enterprise risk register with a single system-level checklist of technical controls
   2. BAlignment of system risk assessments with enterprise risk management
   3. CAccepting every risk whose impact rating falls below the highest level on the scale without review
   4. DTransferring all system-level risks to a cyber insurance carrier to remove them from the register
   Show answer and explanationHide answer

   Correct answer: B

   Using common scales so system risks can be compared with enterprise risks is alignment with enterprise risk management. Replacing the register, transferring every risk to insurance, or accepting everything below the top rating each break the shared view that the request is trying to create.

4. Question 4Systems Security Implementation, Verification and Validation

   Which statement correctly distinguishes verification from validation?

   1. AValidation confirms that the code compiles cleanly, while verification confirms that the finished product is free of vulnerabilities
   2. BVerification is performed only by the vendor during delivery, and validation is performed only by external auditors after launch
   3. CBoth terms describe the same testing activity, so the two are used interchangeably in contracts, plans, and reports
   4. DVerification checks that the system meets its specified requirements, while validation checks that it meets stakeholder needs
   Show answer and explanationHide answer

   Correct answer: D

   Verification asks whether the system was built to its specifications, and validation asks whether it satisfies the stakeholders' actual needs. The other statements assign the wrong meanings, restrict the activities to certain parties, or treat the two as synonyms.

5. Question 5Secure Operations, Change Management and Disposal

   After a system is authorized, the team needs to know whether its security controls remain effective as the system changes over time. Which activity best meets this need?

   1. AA one-time vulnerability scan performed on the day the system receives its authorization decision
   2. BStoring all audit logs offline so they do not consume production disk space on the system
   3. COngoing monitoring of control effectiveness, with periodic reporting to the authorizing official
   4. DAn annual paperwork review that is archived as soon as the authorization letter has been signed
   Show answer and explanationHide answer

   Correct answer: C

   Continuous monitoring checks control effectiveness throughout the system's life and reports changes to the authorizing official. A one-time scan or annual paperwork review cannot show drift, and offline log storage does not assess whether controls work.