ISC2 ISSEP Practice Questions (Free Sample)

125 questions in three hours at Pearson VUE. The format is multiple choice plus advanced item types, so not every question is a straightforward four-option pick. Confirm current logistics at isc2.org when you book, since ISC2 sets the format and may change it.

700 out of 1000 on ISC2’s scaled scoring. That is not a raw 70%, because a scaled score reflects the difficulty of the items you were served rather than a simple count of right answers, and the raw number of correct responses needed can move between forms. The Certifym practice pass mark is set at 70% as an honest raw-score equivalent, and because every set is weighted to the official domain percentages, clearing it means genuine coverage across all five domains rather than luck in the heavy ones.

Systems Security Engineering Foundations is the single heaviest domain at 24%, and it is also the domain that frames the rest — trust concepts, the ISO/IEC/IEEE 15288 process alignment, technical management, and supply chain risk all set the vocabulary the other domains answer in. Security Planning and Engineering follows at 22% and is the design core, where requirements baselines, functional allocation, and trade-off studies live. Risk Management and Systems Security Implementation, Verification and Validation are tied at 20% each. Secure Operations, Change Management and Disposal is lightest at 14%, but it owns sanitization, decommissioning, and change impact assessment, which are exactly the topics candidates skip and then miss.

No — eligibility runs two ways. You can qualify by holding the CISSP plus two years of cumulative experience in one or more ISSEP domains, or without the CISSP on seven years of cumulative experience in two or more domains. The exam is only half of what stands between you and the credential; what counts toward those years is set by ISC2, so check the current eligibility rules on isc2.org rather than relying on a secondhand summary.

ISC2 revised the domains from its latest Job Task Analysis effective August 1, 2025, and threaded AI security engineering through all five of them rather than parking it in one. That means formal validation of ML components, adversarial threat modeling done at requirements time, secure training-data pipelines, hardware-rooted protection of model weights, adversarial testing of AI-driven controls, and drift-triggered retraining and rollback handled under change control. A book written for the pre-2025 outline still covers the classic systems security engineering material well, but it will give you nothing on where AI surfaces inside planning, verification, and operations questions.

They test different things. CISSP proves breadth across the security profession; ISSEP proves you can practice security as a systems engineering discipline — turning protection needs into requirements, architectures, designs, and verified, authorized systems using standards like NIST SP 800-160 and ISO/IEC/IEEE 15288. ISSEP began life as a CISSP concentration and is now a standalone advanced certification, one of the three highest-bar credentials ISC2 offers. Holding the CISSP still shortens the experience requirement from seven years to two, which is the clearest signal ISC2 gives about the order most people take them in.

The sample is a fixed 15-question set spread across the five domains at outline proportions, with no account needed. Members get ten full-length ISSEP practice exams with full explanations, study mode, and domain drills; each full-length attempt is a 125-question timed simulation against a 180-minute clock, drawn to the official weights — 30 questions from Foundations, 25 from Risk Management, 28 from Planning and Engineering, 25 from Implementation and V&V, and 17 from Operations, Change Management and Disposal. New practice content is added every week and your progress is saved when you join. None of the member-bank items appear in this sample.

No. Certifym.net is operated by Certifym Exam Services, LLC and is not affiliated with, endorsed by, or sponsored by ISC2, Inc. All questions and explanations on this site are original content produced by Certifym and are not sourced from actual ISC2 exam questions.