A government agency is developing a new secure messaging system for field agents. The system must allow agents to send encrypted messages, but also must support emergency message recall. The security team is documenting how security is integrated into the system's operational concept. Which document best captures this?

Security Requirements Analysis report

Security Concept of Operations (CONOPS)

System Security Requirements Baseline

A security analyst is reviewing the security requirements for a new cloud-based collaboration tool. She finds that two requirements conflict: one requires data to be stored in the EU for data residency, and another requires data to be accessible from any region for performance. What is the most appropriate action?

Select the data residency requirement as the only requirement because it is more important.

Keep both requirements as is and let the design team figure it out.

Analyze the conflict and propose a revised requirement that balances residency and performance, such as storing data in the EU and using CDN for performance.

Select the performance requirement as the only requirement because it is more critical.

In a Security CONOPS, which element is typically described?

The results of penetration testing

The system's operational functions and how security is incorporated into them

The names of all security personnel assigned to the project

The exact hardware specifications for all system components

A defense contractor is developing a new embedded system for a military aircraft. The system will operate in a contested electromagnetic environment and must function without connectivity to external networks. The program manager wants to ensure that security requirements reflect the system's operational context. Which action is most directly aligned with developing the system security context?

Draft a security requirements baseline from the system's functional specification.

Select encryption algorithms and key management protocols for the system.

Interview pilots and maintenance crews to document the operational environment, threats, and security constraints.

Conduct a security requirements analysis to verify traceability to system objectives.

A healthcare organization is developing a new patient portal. The security team has gathered input from stakeholders and identified security constraints. They now need to document the agreed-upon security needs and constraints for the system. What should they create?

Security Requirements Analysis report

Security Concept of Operations (CONOPS)

System Security Requirements Baseline

Information Systems Security Engineering Professional

Domain 3Objective 3

Develop System Requirements ISSEP Practice Questions (Page 2)

Part of the Security Planning and Engineering domain, which accounts for 22% of the ISSEP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–26 in this domain), expect 4–7 from this objective — we provide 17 practice questions to prepare you well beyond it. (estimate)

17questions here

4free pages

4concepts

22%of the exam

Questions 6–10

6application · medium
A government agency is developing a new secure messaging system for field agents. The system must allow agents to send encrypted messages, but also must support emergency message recall. The security team is documenting how security is integrated into the system's operational concept. Which document best captures this?
Select an answer first
7application · medium
A security analyst is reviewing the security requirements for a new cloud-based collaboration tool. She finds that two requirements conflict: one requires data to be stored in the EU for data residency, and another requires data to be accessible from any region for performance. What is the most appropriate action?
Select an answer first
8foundation · easy
In a Security CONOPS, which element is typically described?
Select an answer first
9application · medium
A defense contractor is developing a new embedded system for a military aircraft. The system will operate in a contested electromagnetic environment and must function without connectivity to external networks. The program manager wants to ensure that security requirements reflect the system's operational context. Which action is most directly aligned with developing the system security context?
Select an answer first
10application · medium
A healthcare organization is developing a new patient portal. The security team has gathered input from stakeholders and identified security constraints. They now need to document the agreed-upon security needs and constraints for the system. What should they create?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSEP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSEP” is a trademark of its owner, used for identification only.

Develop System Requirements ISSEP Practice Questions (Page 2)

Questions 6–10

In a Security CONOPS, which element is typically described?

A healthcare organization is developing a new patient portal. The security team has gathered input from stakeholders and identified security constraints. They now need to document the agreed-upon security needs and constraints for the system. What should they create?

Keep studying — Security Planning and Engineering