About the Exam

ISC2's ISSAP certification validates expertise in information systems security architecture. It is aimed at security architects and related professionals such as system architects, analysts, and chief security officers. Passing demonstrates the ability to develop, design, and analyze security solutions and provide risk-based guidance to senior management.

Exam Topics

  • Governance, Risk, and Compliance (GRC)21%
  • Security Architecture Modeling22%
  • Infrastructure and System Security32%
  • Identity and Access Management (IAM) Architecture25%

How to Use This Practice Exam

  1. Browse — Read each question, select your answer, and reveal the explanation.
  2. Exam Mode — Simulate real exam conditions with a timed session and score report.
  3. Learn Mode — Spaced repetition schedules questions you struggle with for long-term retention.

Download the Full Exam PDF

Get every question and answer in a clean, printable PDF built for offline study. Purchase once, keep permanent access, and re-download the latest version anytime.

Last updated July 10, 2026 at 5:12 PM

Topic filter
Question status
Question sort
Questions per page

QuestionQ1

VerifiedInfrastructure and System Security

You have just configured a wireless network for customers at a coffee shop. Which of the following are appropriate security measures to implement? Each correct answer represents a complete solution.

Choose two
Explanation

WPA encryption protects wireless traffic and is substantially more secure than deprecated WEP. MAC filtering can provide an additional layer of access control by allowing only listed device MAC addresses, whereas suppressing SSID broadcasts does not meaningfully secure a wireless network.

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ2

VerifiedInfrastructure and System Security

Which disaster recovery test involves shutting down operations at the primary site and transferring them to the recovery site in accordance with the disaster recovery plan?

Explanation

A full-interruption test halts production operations at the primary location and moves them to the recovery site, validating that the disaster recovery plan can support an actual failover.

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ3

VerifiedIdentity and Access Management (IAM) Architecture

A helpdesk technician received a phone call from an administrator at a remote branch office. The administrator said that he had forgotten the password for the root account on UNIX servers and requested it. Although the technician did not know any administrator at the branch office, the caller sounded very friendly; because the technician knew the root password, he provided it. What type of attack has just taken place?

Explanation

Social engineering uses deception and interpersonal manipulation to persuade someone to disclose sensitive information. Impersonating a remote administrator and gaining the technician’s trust to obtain the root password is a social-engineering attack.

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ4

VerifiedInfrastructure and System Security

Which of the following serve as countermeasures against a man-in-the-middle attack? Each correct answer is a complete solution. Choose all that apply.

Choose three
Explanation

Public-key infrastructure authentication binds identities to verified public keys, secret-key authentication can authenticate parties that share a protected key, and off-channel verification independently confirms identity or transaction details. Basic authentication by itself does not prevent a man in the middle from intercepting or relaying credentials.

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ5

VerifiedInfrastructure and System Security

As a Network Administrator for NetTech Inc., you need secure communication on the company intranet. You decide to use public and private key pairs. What will you implement to achieve this?

Explanation

A certificate server implements PKI by issuing and managing digital certificates that bind identities to public/private key pairs. Those certificates support encryption, authentication, and secure network communications.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!
Know a question that should be here? Contribute to this exam
Back home