topic Re: Reporting Errors in the ISC2 Self-Study ISSMP Course and Textbook in ISSMP Study Group

Reporting Errors in the ISC2 Self-Study ISSMP Course and Textbook

Larry_E_Potter — Tue, 02 Dec 2025 20:56:50 GMT

Where can I go to report errors in the ISC2 Self-Study ISSMP Course and Textbook?

Re: Reporting Errors in the ISC2 Self-Study ISSMP Course and Textbook

CBMExamTeam — Tue, 02 Dec 2025 21:46:06 GMT

Thank you for reaching out via ISC2 Community.

I've done some research. You may report Official ISC2 Courseware and eTextbook "errata" here:

Content Error Submission

Re: Reporting Errors in the ISC2 Self-Study ISSMP Course and Textbook

Larry_E_Potter — Tue, 02 Dec 2025 23:04:01 GMT

I have submitted my report. If I face a similar question on the same topic on my exam I am taking in less than two weeks, should I answer correctly or answer how the ISC2 training materials have coached me?

Re: Reporting Errors in the ISC2 Self-Study ISSMP Course and Textbook

dcontesti — Wed, 03 Dec 2025 15:35:30 GMT

The best advice is "Choose the best answer" Also carefully read the question. I have this issue, I tend to speed read and sometime, it gets me into issues.

May we see the question you are concerned about?

Re: Reporting Errors in the ISC2 Self-Study ISSMP Course and Textbook

Larry_E_Potter — Thu, 04 Dec 2025 17:08:26 GMT

I hope that providing this one question is not considered an ethical violation of my obligation to protect ISC2's intelectual property. 🙂

Which of the following scoped test methods has the greatest potential for operational variation? (2.3)
A. Black box testing
B. White box testing
C. Gray box testing
D. There is no variance between methods

Re: Reporting Errors in the ISC2 Self-Study ISSMP Course and Textbook

dcontesti — Thu, 04 Dec 2025 19:01:11 GMT

@Larry_E_Potter

I would have picked B. what is the system telling you is the right answer of what do you think the answer should be?

Re: Reporting Errors in the ISC2 Self-Study ISSMP Course and Textbook

nkeaton — Thu, 04 Dec 2025 19:48:51 GMT

@Larry_E_Potter Please remember that the people that develop actual exam questions are not the same people that develop questions for ISC2 training. So in the training there will be answers there that are not correct by ISC2 exam objectives. Follow those and not the training. The questions are to make you think, and the fact that you recognize them as incorrect is good. Best wishes.

Re: Reporting Errors in the ISC2 Self-Study ISSMP Course and Textbook

Larry_E_Potter — Thu, 04 Dec 2025 22:20:52 GMT

The writer's justification does not even make proper use of the terms black/white/gray.

Your answer is correct. C <- WRONG, should be Black Box & Google AI agrees with me 🙂

Gray box testing creates the most operational variation of the three options. This is because there is no strict visibility into the operational scheme as with black box and white box testing, which both have preliminary "knowns" about the scope and conduct of the test.
The operational variation in black box testing is bounded because you are only testing inputs and outputs. White box testing is where all the source code is exposed. This, like black box testing, defines the operational bounds from the beginning. Gray box testing can be extremely variable from test to test. Some gray box tests are more like black box tests, with strict bounds. Others are more like white box tests, which have less strict bounds but also strict knowns. The result is that a gray box test can introduce variability into the environment that neither of the stricter techniques do.

Some extra research....
https://www.eccouncil.org/cybersecurity-exchange/penetration-testing/black-box-gray-box-and-white-box-penetration-testing-importance-and-uses/
https://www.redscan.com/news/types-of-pen-testing-white-box-black-box-and-everything-in-between/

Re: Reporting Errors in the ISC2 Self-Study ISSMP Course and Textbook

Larry_E_Potter — Thu, 04 Dec 2025 22:23:31 GMT

I am disappointed with the Q&A provided in the eBook and the online training. Too many times (80-90%), they telegraph the correct answer by their word/phrase choices and by nearly always being the longest answer. 😞

Re: Reporting Errors in the ISC2 Self-Study ISSMP Course and Textbook

dcontesti — Thu, 04 Dec 2025 22:47:06 GMT

@Larry_E_Potter @CBMExamTeam

I find it unfortunate that you are coming up with so many issues. As I understand it, there could potentially be three different sets of item (question) developers. One for the actual examination. This group develops items, reviews them and finally will review stats on some questions. The second team develops the training (course material and test questions. The third team are the folks that develop the printed materials (books, etc.) Sometimes the second and third team may be the same BUT the first group is totally independent.

I cannot say what process the folks that develop printed material follows but the exam developers and the team developing the training materials do follow the same exacting process for items. The item is developed, put forth, peer reviewed and then used.

The process typically includes developing the stem (questions), selecting the correct answer and then developing three distractors (wrong answers)

@CBMExamTeam If I mis-spoke could you correct me?

Re: Reporting Errors in the ISC2 Self-Study ISSMP Course and Textbook

Kaity — Fri, 05 Dec 2025 18:01:26 GMT

@dcontesti is correct! As part of ISC2’s accreditation from the ANSI National Accreditation Board (ANAB), we must demonstrate that all processes performed by the certification body (i.e., exam-related activities) are independent of training to ensure that confidentiality, information security and impartiality are not compromised. So yes, the teams work independently from one another.

All exam items are written by members holding the specific certification. We greatly appreciate the dedication our membership has shown to develop and maintain gold standard exams. If you’d like to get involved, you can learn more about opportunities for exam development at https://www.isc2.org/volunteer/volunteer-opportunities/exam-development.

Conversely, if you’re interested in volunteering as an Education Subject Matter Expert (SME) to develop material for our courses, you can find more information at https://www.isc2.org/volunteer/volunteer-opportunities/education-subject-matter-expert.

I’ve shared this thread with the folks in our education team for their attention. As mentioned on another thread, if you find an error in course material, please send it to us for review. You can find the submission form here: https://forms.monday.com/forms/69fb227889bb5158e4b3e43d8fe3f547?r=use1

Thank you everyone!!

Re: Reporting Errors in the ISC2 Self-Study ISSMP Course and Textbook

riffjim4069 — Sat, 06 Dec 2025 20:42:48 GMT

@Larry_E_Potter

I would have gone with "A: Black Box testing" as having the greatest potential...etc. However, I really don't like how the question is structed since it could be interpreted as asking which test method itself varies the most in how it's applied, rather than which test method is best suited to detect or measure operational variation in a system.

I believe the question is asking the exam-taker to demonstrate an understanding of how to best test operational system controls. You can architect, design, build, configure, and white box test them all you wish, but until the system is deployed (at least in a testing/staging area) and black box tested, you really don't know the effectiveness of those systems in an operational environment. It's the security control completeness & effectiveness that you're trying to capture along with its operational variance. Just my two-cents.

By rephrasing to “has the greatest potential for measuring or testing for operational variation”, you shift the focus to the method’s capability to reveal inconsistencies in system behavior across different operational conditions. This aligns better with the intent if the goal is to assess variation rather than the variability of the method itself. I'd re-write this question to:

Which of the following scoped test methods has the has the greatest potential for measuring or testing for operational variation?

A. Black box testing
B. White box testing
C. Gray box testing
D. There is no variance between methods

Finally, I don't have a problem with the eTextbook questions. I believe they're designed to be a repetitive and reenforced learning activity as opposed to an exam cram session. I've done several of these reinforced learning style Q&A decks that I added to Anki - mostly CompTIA, AI, or network related. I didn't like them at first (80, 90%+ correct rate seemed too easy) but much of it was refresher material, and the good Q&A decks would decompose difficult topics (into very basic elements) and link them together using repitition and reenforced learning to ensure mastery. I believe this is the format of the eTextbooks I've seen.

Cheers!