ISC2 ISSEP QUESTIONS AND ANSWERS | VERIFIED
AND WELL DETAILED ANSWERS | PLUS RATIONALES
| GUARANTEED PASS | LATEST EXAM UPDATE |
STUVIA VERIFIED | EXAM PREP | STUDY GUIDE |
PRACTICE TEST
,ISSEP Practice Exam: 100 Questions
Note on the Exam: The ISSEP is heavily based on NIST SP 800-160 Vol. 1 (Systems Security Engineering) and
ISO/IEC/IEEE 15288. The questions below prioritize the "why" and the process over simple memorization.
Domain 1: Systems Security Engineering (SSE) Foundation & NIST 800-160
1. According to NIST SP 800-160, what is the primary goal of Systems Security Engineering (SSE)?
A. To eliminate all residual risk from a system.
B. To ensure the system meets its security requirements and maintains trustworthiness throughout its lifecycle.
C. To perform a penetration test before deployment.
D. To document vulnerabilities in a POA&M.
,Answer: B
Rationale: SSE is a specialty discipline of systems engineering. Its goal is to ensure security is designed in, not
bolted on, ensuring the system is trustworthy and resilient. "Eliminating all risk" (A) is impossible.
2. Which document provides the foundational framework for the ISSEP exam?
A. NIST SP 800-53
B. NIST SP 800-160 Vol. 1
C. ISO 27001
D. NIST SP 800-37
Answer: B
Rationale: NIST SP 800-160 Vol. 1, "Systems Security Engineering: Considerations for a Multidisciplinary
Approach in the Engineering of Trustworthy Secure Systems," is the core reference for ISSEP.
3. In the context of SSE, what does "Trustworthiness" refer to?
A. The system's ability to pass an audit.
B. The degree to which the system can be trusted to behave as expected under various conditions, including
adversarial ones.
, C. The encryption strength of the system's database.
D. The vendor's reputation.
Answer: B
Rationale: Trustworthiness is the property of a system being worthy of trust. It includes security, safety,
reliability, and resilience.
4. What is the primary purpose of the "System Security Context" in NIST 800-160?
A. To define the firewall rules.
B. To establish the boundaries, operational environment, and constraints for the system.
C. To list the CVE numbers of the software.
D. To calculate the ROI of the security budget.
Answer: B
Rationale: The security context defines what the system is, where it operates, and what it must interface with. It
sets the stage for deriving security requirements.
5. Which of the following is NOT a core property of a trustworthy secure system?
AND WELL DETAILED ANSWERS | PLUS RATIONALES
| GUARANTEED PASS | LATEST EXAM UPDATE |
STUVIA VERIFIED | EXAM PREP | STUDY GUIDE |
PRACTICE TEST
,ISSEP Practice Exam: 100 Questions
Note on the Exam: The ISSEP is heavily based on NIST SP 800-160 Vol. 1 (Systems Security Engineering) and
ISO/IEC/IEEE 15288. The questions below prioritize the "why" and the process over simple memorization.
Domain 1: Systems Security Engineering (SSE) Foundation & NIST 800-160
1. According to NIST SP 800-160, what is the primary goal of Systems Security Engineering (SSE)?
A. To eliminate all residual risk from a system.
B. To ensure the system meets its security requirements and maintains trustworthiness throughout its lifecycle.
C. To perform a penetration test before deployment.
D. To document vulnerabilities in a POA&M.
,Answer: B
Rationale: SSE is a specialty discipline of systems engineering. Its goal is to ensure security is designed in, not
bolted on, ensuring the system is trustworthy and resilient. "Eliminating all risk" (A) is impossible.
2. Which document provides the foundational framework for the ISSEP exam?
A. NIST SP 800-53
B. NIST SP 800-160 Vol. 1
C. ISO 27001
D. NIST SP 800-37
Answer: B
Rationale: NIST SP 800-160 Vol. 1, "Systems Security Engineering: Considerations for a Multidisciplinary
Approach in the Engineering of Trustworthy Secure Systems," is the core reference for ISSEP.
3. In the context of SSE, what does "Trustworthiness" refer to?
A. The system's ability to pass an audit.
B. The degree to which the system can be trusted to behave as expected under various conditions, including
adversarial ones.
, C. The encryption strength of the system's database.
D. The vendor's reputation.
Answer: B
Rationale: Trustworthiness is the property of a system being worthy of trust. It includes security, safety,
reliability, and resilience.
4. What is the primary purpose of the "System Security Context" in NIST 800-160?
A. To define the firewall rules.
B. To establish the boundaries, operational environment, and constraints for the system.
C. To list the CVE numbers of the software.
D. To calculate the ROI of the security budget.
Answer: B
Rationale: The security context defines what the system is, where it operates, and what it must interface with. It
sets the stage for deriving security requirements.
5. Which of the following is NOT a core property of a trustworthy secure system?
