Home · (ISC)² Certified Information Systems Security Professional
(ISC)² Certified Information Systems Security Professional
This certification is for experienced security practitioners, managers, and executives interested in proving their knowledge across a wide array of security practices and principles. Passing the exam demonstrates the advanced knowledge and technical skills to design, engineer, and manage an organization's overall security posture.
About this practice. Revision Robin is built and maintained by Bloor Engineering Ltd, a UK-registered company. Our (ISC)² Certified Information Systems Security Professional questions are written and reviewed in-house to match the current syllabus, each with a plain-English worked explanation. They are original practice material, not the official exam questions and not affiliated with or endorsed by (ISC)². Always confirm current test rules, fees and content with the official provider. See our Terms and Privacy.
Weak on a topic? Drill just that one till it clicks, then move on.
Free practice questions
Try 3 real (ISC)² Certified Information Systems Security Professional questions
Have a go, then reveal the worked explanation. A taster from a bank of 208 original questions. Unlock for unlimited drills and full timed mocks.
Q1. According to the (ISC)² Code of Ethics, which canon holds the highest priority and must be followed above all others?
A. Provide diligent and competent service to principals.
B. Act honorably, honestly, justly, responsibly, and legally.
C. Protect society, the common good, necessary public trust and confidence, and the infrastructure.
D. Advance and protect the profession.
Show answer & explanation
✓ Answer: C. Protect society, the common good, necessary public trust and confidence, and the infrastructure.
The first canon, 'Protect society, the common good...', is considered paramount. All other professional responsibilities and actions are secondary to this primary directive.
Q2. An organization is decommissioning several solid-state drives (SSDs) that contained highly sensitive information. Which data sanitization method is MOST effective for these devices?
A. Degaussing
B. Standard Formatting
C. Cryptographic Erase (Crypto-Shredding)
D. Overwriting with a single pass of zeros
Show answer & explanation
✓ Answer: C. Cryptographic Erase (Crypto-Shredding)
Degaussing is ineffective on SSDs as they store data electronically, not magnetically. Cryptographic erase, which involves destroying the encryption key, is the most effective and efficient method for sanitizing SSDs.
Q3. When evaluating a system's security architecture, what is the primary characteristic of the Trusted Computing Base (TCB)?
A. It includes all hardware and software components within a system.
B. It is the set of all protective mechanisms within a system responsible for enforcing the security policy.
C. It is a third-party service that validates the system's security posture.
D. It refers exclusively to the cryptographic hardware module, such as a TPM.
Show answer & explanation
✓ Answer: B. It is the set of all protective mechanisms within a system responsible for enforcing the security policy.
The TCB is the totality of protection mechanisms (hardware, firmware, software) that are responsible for enforcing a security policy. It should be kept as small as possible to be verifiable.
Exam mode
Full mock exam
40 random questions, real timing, marked against the official pass mark. Different every time.
The first 8 of 40 questions are free, with your score on them. Finishing the paper, your result against the pass mark and every answer explained come with the paid version.
Try it free
Topic drills
Ten quick questions on one topic, marked instantly with explanations.
1 free drill left.
Who has to sit the (ISC)² Certified Information Systems Security Professional
Who needs a (ISC)² Certified Information Systems Security Professional?
Experienced security practitioners, managers, and executives. Requires 5 years paid work in 2+ domains.
The real (ISC)² Certified Information Systems Security Professional: format
How many questions are in the (ISC)² Certified Information Systems Security Professional?
The real (ISC)² Certified Information Systems Security Professional has 100 questions and lasts 180 minutes. Our mock uses 40 questions in 45 minutes.
What is the (ISC)² Certified Information Systems Security Professional pass mark?
Real exam pass mark: 700 out of 1,000 (scaled score). Our mock marks you at 28 out of 40, the threshold we mark against.
What it costs, and what a resit costs
How much does the (ISC)² Certified Information Systems Security Professional cost?
Real exam fee: £607. Resit fee: £607. Rebooking after a fail: 30 days after 1st attempt, 60 after 2nd, 90 after 3rd+. Max 4 attempts in 12 months.
How hard is it
What is the (ISC)² Certified Information Systems Security Professional pass rate?
Real exam first-time pass rate: ISC2 does not publish official rates; estimates are 50-60%. Difficulty: High. Requires 5 years of experience; management-level, risk-based thinking, not purely technical.
Why people fail it
Why do people fail the (ISC)² Certified Information Systems Security Professional?
Answering as a technician instead of a security manager/CISO.
Relying on memorization rather than understanding and applying concepts.
Poor time management and misinterpreting tricky, scenario-based questions.
Figures for the real exam from vertexaisearch.cloud.google.com, checked October 2026. Fees and rules change, so confirm with the test provider before you book.
(ISC)² Certified Information Systems Security Professional: common questions
Frequently asked
How long do you get?
The test is timed at 45 minutes. Our full mock runs on the same clock so you can practise your pacing.
Are these the real exam questions?
No. Our questions are original and written to match the current syllabus, so they give realistic practice without copying the official paper. Every answer comes with a plain-English explanation. Always confirm current rules and content with (ISC)².