About the Exam

ISSEP is ISC2’s information systems security engineering certification for professionals who incorporate security into projects, applications, business processes, and information systems. It is aimed at systems security engineering professionals and lists CISSP plus additional experience as the prerequisite. Passing demonstrates knowledge of system security engineering processes, technical procurement and management, risk management and operations, security planning and engineering, and security design and systems requirement setting.

Exam Topics

  • Systems Security Engineering Foundations24%
  • Risk Management20%
  • Security Planning and Engineering22%
  • Systems Security Implementation, Verification and Validation20%
  • Secure Operations, Change Management and Disposal14%

How to Use This Practice Exam

  1. Browse — Read each question, select your answer, and reveal the explanation.
  2. Exam Mode — Simulate real exam conditions with a timed session and score report.
  3. Learn Mode — Spaced repetition schedules questions you struggle with for long-term retention.

Download the Full Exam PDF

Get every question and answer in a clean, printable PDF built for offline study. Purchase once, keep permanent access, and re-download the latest version anytime.

Last updated November 30, 2025 at 9:17 AM

Topic filter
Question status
Question sort
Questions per page

QuestionQ1

VerifiedSystems Security Implementation, Verification and Validation

FITSAF means Federal Information Technology Security Assessment Framework. It is a methodology used to assess the security of information systems. Which FITSAF level indicates that the procedures and controls have been tested and reviewed?

Explanation

FITSAF Level 4 represents the stage at which implemented procedures and controls are tested and reviewed. Level 5 is the subsequent stage, in which those procedures and controls are fully integrated into a comprehensive security program.

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ2

VerifiedSecure Operations, Change Management and Disposal

Which of the following is a type of security management for computers and networks intended to identify security breaches?

Explanation

An Intrusion Detection System (IDS) monitors and analyzes computer or network activity to detect security incidents, suspicious behavior, and potential breaches.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ4

VerifiedSecurity Planning and Engineering

Which Registration Task informs the DAA, Certifier, and User Representative that the system requires C&A Support?

Explanation

Registration Task 2 registers the system by informing the DAA, Certifier, and User Representative that the system will require certification and accreditation (C&A) support.

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ5

VerifiedSystems Security Implementation, Verification and Validation

Which of the following Security Control Assessment Tasks collects the documentation and supporting materials necessary to assess the security controls in the information system?

Explanation

NIST SP 800-37 identifies Task 4 as the Security Control Assessment task, including the subtask for documentation and supporting materials required to assess information-system security controls.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ6

VerifiedSystems Security Engineering Foundations

Which of the following firewall types enhances the security of data packets by retaining the state of a connection at the network and session layers as they pass through the filter?

Explanation

A stateful packet-filter firewall keeps connection-state information, allowing it to determine whether a packet belongs to an established or valid session and apply filtering decisions in that context. Cisco describes stateful inspection as monitoring the state of network connections, unlike simple packet filtering that does not validate packet sequence or connection context.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!
Know a question that should be here? Contribute to this exam
Back home