A government agency is evaluating deployment models for a new system that processes classified data. The agency has strict requirements for physical control of the hardware and the ability to inspect all components. However, it also needs to scale computing resources quickly during peak periods. Which deployment model best balances these conflicting requirements?

On-premises private cloud with the ability to burst to a community cloud during peak periods

Public cloud with a dedicated tenancy option

Hybrid cloud using a public provider for all processing

Community cloud only, with no on-premises component

A security architect is reviewing a legacy application that will be migrated to a new platform. The application has no existing security documentation, and the team is unsure which security requirements apply. The architect wants to ensure that all security requirements are identified and traceable, while also planning for monitoring of the new platform. Which approach is most effective?

Use a generic security checklist and skip documentation

Conduct a threat modeling exercise to identify requirements, then create an RTM and integrate monitoring into the new platform

Rely on the new platform's built-in security features and do not create an RTM

Deploy monitoring first and then document requirements later

A healthcare organization is required to monitor its infrastructure for security incidents, but it also must encrypt all patient data in transit and at rest. The security team wants to ensure that monitoring data itself is protected from tampering. Which approach best meets these requirements?

Collect logs in plaintext and store them in a SIEM without additional protection

Use a separate logging server with no encryption but restrict physical access

Encrypt logs only at rest, but transmit them over an internal network without TLS

Use TLS for log transmission and encrypt the log storage at rest, with access controls on the SIEM

What is the primary purpose of a Requirements Traceability Matrix (RTM) in application security?

To track the progress of software development tasks

To document the application's architecture

To map security requirements to design and test artifacts

To list all known vulnerabilities in the application

Information Systems Security Architecture Professional

Domain 3Objective 1

3.1 Identify Infrastructure and System Security Requirements ISSAP Practice Questions (Page 4)

Part of the Infrastructure and System Security Architecture domain, which accounts for 32% of the ISSAP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~22–38 in this domain), expect 7–13 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

6concepts

32%of the exam

Questions 16–20

16expert · hard
A government agency is evaluating deployment models for a new system that processes classified data. The agency has strict requirements for physical control of the hardware and the ability to inspect all components. However, it also needs to scale computing resources quickly during peak periods. Which deployment model best balances these conflicting requirements?
Select an answer first
17expert · hard
A security architect is reviewing a legacy application that will be migrated to a new platform. The application has no existing security documentation, and the team is unsure which security requirements apply. The architect wants to ensure that all security requirements are identified and traceable, while also planning for monitoring of the new platform. Which approach is most effective?
Select an answer first
18foundation · easy
Which physical security control is specifically designed to limit the spread of a fire within a facility?
Select an answer first
19application · medium
A healthcare organization is required to monitor its infrastructure for security incidents, but it also must encrypt all patient data in transit and at rest. The security team wants to ensure that monitoring data itself is protected from tampering. Which approach best meets these requirements?
Select an answer first
20foundation · easy
What is the primary purpose of a Requirements Traceability Matrix (RTM) in application security?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSAP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSAP” is a trademark of its owner, used for identification only.

3.1 Identify Infrastructure and System Security Requirements ISSAP Practice Questions (Page 4)

Questions 16–20

Which physical security control is specifically designed to limit the spread of a fire within a facility?

A healthcare organization is required to monitor its infrastructure for security incidents, but it also must encrypt all patient data in transit and at rest. The security team wants to ensure that monitoring data itself is protected from tampering. Which approach best meets these requirements?

What is the primary purpose of a Requirements Traceability Matrix (RTM) in application security?

Keep studying — Infrastructure and System Security Architecture