[NEW] Certified Information Systems Security Professional

Asset Security (10%) Topics cover the classification, handling, and protection of information and assets throughout their lifecycle.

free isc2 issap 2026 practice tests security architecture course and Engineering (13%) Topics focus on designing, implementing, and managing secure system architectures, with a strong emphasis on cryptography for data in transit and at rest.

Communication and Network Security (13%) Topics involve designing and protecting network architectures, secure communication channels, and network components.

Identity and Access Management (IAM) (13%) Topics include physical and logical access controls, identification, authentication, and identity as a service.

Security Assessment and Testing (12%) Topics focus on designing, performing, and analyzing security testing, including vulnerability assessments and penetration testing.

Security Operations (13%) Topics cover incident management, disaster recovery, logging, monitoring, and the day-to-day operational security of an enterprise.

Software Development Security (10%) Topics address integrating security controls within the software development life cycle (SDLC) and assessing the security impact of acquired software.

B. NIST SP 800-37

C. COBIT 2019

D. ITIL v4

E. PCI DSS

F. HIPAA Security Rule

Correct Answer: B

Explanation:

Option B is correct because NIST SP 800-37 is the authoritative guide for applying the Risk Management Framework to federal information systems.

Option C is incorrect because COBIT 2019 is a framework for enterprise IT governance and management.

Option D is incorrect because ITIL v4 focuses on IT service management rather than federal security risk management.

Option E is incorrect because PCI DSS applies to organizations handling credit card data, not federal systems.

Option F is incorrect because the HIPAA Security Rule dictates the protection of electronic protected health information in the healthcare sector.

B. ECC

C. Rijndael

D. Diffie-Hellman

E. SHA-256

F. MD5

Correct Answer: C

Explanation:

Option B is incorrect because Elliptic Curve Cryptography (ECC) is an asymmetric algorithm known for its efficiency.

Option C is correct because Rijndael was the specific symmetric key block cipher submitted by Joan Daemen and Vincent Rijmen that NIST ultimately selected to become the Advanced Encryption Standard (AES).

Option D is incorrect because Diffie-Hellman is a method for securely exchanging cryptographic keys over a public channel, not a symmetric block cipher.

Option E is incorrect because SHA-256 is a cryptographic hashing function, not an encryption cipher.

Option F is incorrect because MD5 is an older, deprecated hashing algorithm.

B. Discretionary Access Control (DAC)

C. Mandatory Access Control (MAC)

D. Attribute-Based Access Control (ABAC)

E. Rule-Based Access Control (RuBAC)

F. Context-Dependent Access Control

Correct Answer: C

Explanation:

Option B is incorrect because DAC allows the owner of a resource to determine who has access to it.

Option C is correct because Mandatory Access Control (MAC) strictly enforces access policies based on data classification labels (objects) and user security clearances (subjects).

Option D is incorrect because ABAC grants access dynamically based on policies that evaluate attributes of the user, resource, and environment.

Option E is incorrect because RuBAC relies on specific, administrator-defined rules (like firewall ACLs) rather than system-wide security clearances.

Option F is incorrect because Context-Dependent Access Control evaluates the state or sequence of events before granting access.

Welcome to the Mock Exam Practice Tests Academy to help you prepare for your CISSP Certification.

You can retake the exams as many times as you want

This is a huge original question bank

You get support from instructors if you have questions

Each question has a detailed explanation

Mobile-compatible with the Udemy app