What is the primary purpose of infrastructure monitoring in a security context?

To detect and respond to security incidents

To improve system performance and speed

An energy company has OT systems that control pipeline valves. The systems use legacy protocols and have limited processing power. The company wants to add encryption to protect communications between OT devices and the control center, but the devices cannot handle complex encryption algorithms. Which approach is most appropriate?

Use strong encryption algorithms directly on the OT devices

Use a VPN concentrator at the control center only

Disable encryption and rely on network segmentation

Use lightweight encryption algorithms and hardware security modules (HSMs) to offload cryptographic operations

A large enterprise is adopting a cloud-first strategy, but its security team is concerned about losing visibility into application security. The team wants to ensure that security requirements are consistently applied across all applications, whether on-premises or in the cloud. Which approach best supports this goal?

Use a single RTM but do not document the architecture

Rely on the cloud provider's security certifications and skip internal documentation

Develop separate security architectures for on-premises and cloud, with no cross-referencing

Create a single security architecture document that covers both on-premises and cloud environments, and use it to drive an RTM

Information Systems Security Architecture Professional

Domain 3Objective 1

3.1 Identify Infrastructure and System Security Requirements ISSAP Practice Questions (Page 3)

Part of the Infrastructure and System Security Architecture domain, which accounts for 32% of the ISSAP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~22–38 in this domain), expect 7–13 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

6concepts

32%of the exam

Questions 11–15

11foundation · easy
What is the primary purpose of infrastructure monitoring in a security context?
Select an answer first
12application · medium
An energy company has OT systems that control pipeline valves. The systems use legacy protocols and have limited processing power. The company wants to add encryption to protect communications between OT devices and the control center, but the devices cannot handle complex encryption algorithms. Which approach is most appropriate?
Select an answer first
13foundation · easy
Which cryptographic solution is most appropriate for protecting data at rest on a hard drive?
Select an answer first
14foundation · easy
Which deployment model is characterized by an organization maintaining its own physical data center infrastructure while also utilizing cloud services for additional capacity or specific workloads?
Select an answer first
15expert · hard
A large enterprise is adopting a cloud-first strategy, but its security team is concerned about losing visibility into application security. The team wants to ensure that security requirements are consistently applied across all applications, whether on-premises or in the cloud. Which approach best supports this goal?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSAP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSAP” is a trademark of its owner, used for identification only.

3.1 Identify Infrastructure and System Security Requirements ISSAP Practice Questions (Page 3)

Questions 11–15

What is the primary purpose of infrastructure monitoring in a security context?

Which cryptographic solution is most appropriate for protecting data at rest on a hard drive?

Which deployment model is characterized by an organization maintaining its own physical data center infrastructure while also utilizing cloud services for additional capacity or specific workloads?

Keep studying — Infrastructure and System Security Architecture