A hospital is considering a cloud-based electronic health record (EHR) system. The hospital must ensure that patient data is protected and that the physical location of the data meets regulatory requirements. Which deployment model and physical security consideration are most appropriate?

On-premises data center with no cloud involvement

Public cloud with a region in the hospital's country and provider certifications for physical security

Public cloud with data stored in multiple countries for redundancy

Hybrid cloud with data stored on-premises and processed in the cloud

A financial institution is designing a new data center. The compliance team requires that sensitive data storage areas be protected from unauthorized physical access, and the facility must also safeguard against fire damage without compromising data integrity. Which combination of physical security controls should the architect specify?

Mantraps at the perimeter and water-based sprinklers in server rooms

Unarmed security guards and standard HVAC systems

CCTV only and rely on off-site backups for fire recovery

Biometric access controls on data center doors and a gas-based fire suppression system in server rooms

A startup is building a multi-tenant SaaS application on a public cloud. The security architect must ensure that each tenant's data is isolated and encrypted at rest. Which approach is most appropriate?

Use a separate database instance for each tenant and encrypt each database with a unique key

Store all tenant data in flat files and encrypt the files with a single key

Use a shared database with a tenant ID column and encrypt the entire database with one key

Use a shared database and rely on application-level access controls only

Which practice is an example of a secure coding technique?

Storing passwords in plain text for simplicity

Using client-side validation as the only security check

Using parameterized queries to prevent SQL injection

Disabling all error messages to improve user experience

A pharmaceutical company has a research lab with sensitive intellectual property. The lab's OT systems control environmental conditions, and the IT network manages email and file storage. The company wants to protect the OT systems from physical tampering and ensure they are not accessible from the IT network. Which set of controls is most appropriate?

Use wireless connections for OT systems to avoid physical cabling

Install CCTV only and rely on network segmentation

Place OT systems in a separate locked room and use a unidirectional gateway to the IT network

Connect OT systems directly to the IT network for easier monitoring

Information Systems Security Architecture Professional

Domain 3Objective 1

3.1 Identify Infrastructure and System Security Requirements ISSAP Practice Questions (Page 2)

Part of the Infrastructure and System Security Architecture domain, which accounts for 32% of the ISSAP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~22–38 in this domain), expect 7–13 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

6concepts

32%of the exam

Questions 6–10

6application · medium
A hospital is considering a cloud-based electronic health record (EHR) system. The hospital must ensure that patient data is protected and that the physical location of the data meets regulatory requirements. Which deployment model and physical security consideration are most appropriate?
Select an answer first
7application · medium
A financial institution is designing a new data center. The compliance team requires that sensitive data storage areas be protected from unauthorized physical access, and the facility must also safeguard against fire damage without compromising data integrity. Which combination of physical security controls should the architect specify?
Select an answer first
8application · medium
A startup is building a multi-tenant SaaS application on a public cloud. The security architect must ensure that each tenant's data is isolated and encrypted at rest. Which approach is most appropriate?
Select an answer first
9foundation · easy
Which practice is an example of a secure coding technique?
Select an answer first
10application · medium
A pharmaceutical company has a research lab with sensitive intellectual property. The lab's OT systems control environmental conditions, and the IT network manages email and file storage. The company wants to protect the OT systems from physical tampering and ensure they are not accessible from the IT network. Which set of controls is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSAP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSAP” is a trademark of its owner, used for identification only.

3.1 Identify Infrastructure and System Security Requirements ISSAP Practice Questions (Page 2)

Questions 6–10

A hospital is considering a cloud-based electronic health record (EHR) system. The hospital must ensure that patient data is protected and that the physical location of the data meets regulatory requirements. Which deployment model and physical security consideration are most appropriate?

A startup is building a multi-tenant SaaS application on a public cloud. The security architect must ensure that each tenant's data is isolated and encrypted at rest. Which approach is most appropriate?

Which practice is an example of a secure coding technique?

Keep studying — Infrastructure and System Security Architecture