A data center operator wants to enhance physical security by implementing internal zoning to protect the most sensitive systems. They also need to monitor who enters these zones. Which combination of controls should be implemented?

A single entrance with a security guard and CCTV

Mantraps between zones and badge readers with audit logs

CCTV cameras at every desk and no access controls

Biometric locks on all exterior doors only

A software development team is building a new customer-facing web application. The security architect requires that every security requirement be traceable to a specific design element and that the application be monitored for security events after deployment. Which set of artifacts and practices should the architect mandate?

A threat model and a disaster recovery plan

A detailed network diagram and a firewall rule set

A Requirements Traceability Matrix (RTM) linking security requirements to architecture components, plus integration of logging and monitoring into the application

A secure coding checklist and a penetration test report

A multinational corporation is moving its customer database to a public cloud provider. The data is subject to data residency regulations that require it to remain within a specific country. The corporation also needs to protect the data in transit between its on-premises applications and the cloud. Which combination of controls should be implemented?

Store data on-premises and use a VPN to the cloud for analytics

Use a private cloud with no internet connectivity

Select a cloud region in the required country and use TLS for all data transfers

Use any cloud region and rely on encryption at rest only

Which characteristic is most typical of an operational technology (OT) environment compared to an information technology (IT) environment?

Use of proprietary protocols and legacy systems

Priority on confidentiality over availability

Rapid adoption of new software versions

High tolerance for reboots and patches

A logistics company operates a fleet of vehicles with IoT sensors that send telemetry to a cloud platform. The company also has on-premises servers for legacy applications. The security team wants to ensure that telemetry data is protected in transit and that the on-premises servers are monitored. Which deployment model and controls are most appropriate?

Hybrid deployment with TLS for telemetry and SIEM monitoring for on-premises servers

Use a public cloud for everything and rely on the provider's monitoring

Keep everything on-premises and use VPN for telemetry

Migrate all legacy applications to the cloud and use a single cloud SIEM

Information Systems Security Architecture Professional

Domain 3Objective 1

3.1 Identify Infrastructure and System Security Requirements ISSAP Practice Questions (Page 5)

Part of the Infrastructure and System Security Architecture domain, which accounts for 32% of the ISSAP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~22–38 in this domain), expect 7–13 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

6concepts

32%of the exam

Questions 21–25

21application · medium
A data center operator wants to enhance physical security by implementing internal zoning to protect the most sensitive systems. They also need to monitor who enters these zones. Which combination of controls should be implemented?
Select an answer first
22application · medium
A software development team is building a new customer-facing web application. The security architect requires that every security requirement be traceable to a specific design element and that the application be monitored for security events after deployment. Which set of artifacts and practices should the architect mandate?
Select an answer first
23application · medium
A multinational corporation is moving its customer database to a public cloud provider. The data is subject to data residency regulations that require it to remain within a specific country. The corporation also needs to protect the data in transit between its on-premises applications and the cloud. Which combination of controls should be implemented?
Select an answer first
24foundation · easy
Which characteristic is most typical of an operational technology (OT) environment compared to an information technology (IT) environment?
Select an answer first
25application · medium
A logistics company operates a fleet of vehicles with IoT sensors that send telemetry to a cloud platform. The company also has on-premises servers for legacy applications. The security team wants to ensure that telemetry data is protected in transit and that the on-premises servers are monitored. Which deployment model and controls are most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSAP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSAP” is a trademark of its owner, used for identification only.

3.1 Identify Infrastructure and System Security Requirements ISSAP Practice Questions (Page 5)

Questions 21–25

A data center operator wants to enhance physical security by implementing internal zoning to protect the most sensitive systems. They also need to monitor who enters these zones. Which combination of controls should be implemented?

Which characteristic is most typical of an operational technology (OT) environment compared to an information technology (IT) environment?

Keep studying — Infrastructure and System Security Architecture