A security architect identifies a gap in the design and must decide how to address it. Which set of options should the architect consider?

Alternative solutions, mitigations, and compensating controls

Only controls recommended by the vendor

Only the most expensive control available

Only controls that are already implemented elsewhere

A security architect is validating a new remote access solution. The threat model identified a gap: the design does not include multi-factor authentication (MFA) for VPN access. The architect is considering adding MFA or implementing a network access control (NAC) solution. The organization's policy requires MFA for all remote access. Which action should the architect take?

Conduct a tabletop exercise to discuss the MFA requirement.

Implement NAC to enforce endpoint compliance before allowing VPN access.

Add MFA to the VPN authentication process.

Accept the risk because the VPN is only used by trusted employees.

A healthcare organization is validating a new patient portal design that will handle PHI. The design includes role-based access control and encryption at rest. The security architect wants to validate the design against real-world attack scenarios before development is complete. Which validation method is most appropriate at this stage?

Conduct a tabletop exercise with stakeholders to walk through a simulated breach scenario and evaluate the design's response.

Perform a static code review of the authentication module to identify vulnerabilities in the implementation.

Use modeling and simulation to test the access control logic and encryption flows against attack scenarios.

Deploy a pilot and run a penetration test against the portal to identify exploitable vulnerabilities.

Information Systems Security Architecture Professional

Domain 2Objective 2

2.2 Verify and Validate Design (e.g., Functional Acceptance Testing, Regression) ISSAP Practice Questions (Page 3)

Part of the Security Architecture Modeling domain, which accounts for 22% of the ISSAP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 8–13 from this objective — we provide 21 practice questions to prepare you well beyond it. (estimate)

21questions here

5free pages

5concepts

22%of the exam

Questions 11–15

11foundation · easy
A security architect wants to identify vulnerabilities in the source code of an application without executing it. Which code review methodology should be used?
Select an answer first
12foundation · easy
A security architect identifies a gap in the design and must decide how to address it. Which set of options should the architect consider?
Select an answer first
13application · medium
A security architect is validating a new remote access solution. The threat model identified a gap: the design does not include multi-factor authentication (MFA) for VPN access. The architect is considering adding MFA or implementing a network access control (NAC) solution. The organization's policy requires MFA for all remote access. Which action should the architect take?
Select an answer first
14application · medium
A healthcare organization is validating a new patient portal design that will handle PHI. The design includes role-based access control and encryption at rest. The security architect wants to validate the design against real-world attack scenarios before development is complete. Which validation method is most appropriate at this stage?
Select an answer first
15foundation · easy
A security architect wants to validate a design by having a team walk through a simulated cyberattack scenario to discuss responses. Which validation method is being used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSAP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSAP” is a trademark of its owner, used for identification only.

2.2 Verify and Validate Design (e.g., Functional Acceptance Testing, Regression) ISSAP Practice Questions (Page 3)

Questions 11–15

A security architect wants to identify vulnerabilities in the source code of an application without executing it. Which code review methodology should be used?

A security architect identifies a gap in the design and must decide how to address it. Which set of options should the architect consider?

A security architect wants to validate a design by having a team walk through a simulated cyberattack scenario to discuss responses. Which validation method is being used?

Keep studying — Security Architecture Modeling