Analyze Organizational and Operational Environment ISSEP Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A healthcare organization is implementing a new patient portal that will allow patients to access their medical records online. The project team has gathered requirements from the IT department and the compliance office. However, they have not yet consulted the patients who will use the portal. The compliance office requires that all access be logged and that patients have the ability to revoke access to their data. The IT department wants to minimize the cost of storage. What is the most important next step to ensure the portal meets the needs of all stakeholders?

   • AConduct a workshop with a representative group of patients to elicit their security and usability requirements.
   • BDefer patient input until after the system is built, to avoid delaying the project.
   • CAsk the compliance office to represent patient interests, since they are responsible for data protection.
   • DProceed with the requirements from IT and compliance, as they are the primary stakeholders for security.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Why is responsibility assignment important in security planning?

   • AIt ensures clear ownership and traceability of security tasks
   • BIt documents assumptions about the operational environment
   • CIt identifies all stakeholders affected by the system
   • DIt determines the feasibility of security requirements
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A retail company is developing a new loyalty program that will collect customer purchase history. The marketing team wants to use the data for targeted advertising. The privacy officer requires that customers be able to opt out of data collection. The IT team is concerned about the cost of storing the data. The systems security engineer is tasked with eliciting requirements from stakeholders. Which technique would be most effective to gather requirements from a large and diverse group of customers?

   • AOrganize a focus group with the marketing and IT teams only.
   • BHold a series of one-on-one interviews with a few customers.
   • CConduct an online survey to gather customer preferences regarding data collection and privacy.
   • DReview the company's existing customer data to infer preferences.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Documenting assumptions about the operational environment, such as threat landscape and user behavior, that underlie security decisions is known as:

   • AValidation plan development
   • BRequirements elicitation
   • CConstraint identification
   • DAssumption documentation
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which of the following is a validation method used to verify security controls?

   • ARole definition
   • BStakeholder identification
   • CTesting
   • DRequirements elicitation
   Reveal Solution Discussion Select an answer first