An organization is adopting ISO/IEC 24641:2023 to improve its systems engineering processes. The organization wants to ensure that security requirements are traceable from the concept phase through to disposal. Which process defined by the standard should be used to achieve this?

Creating a separate security requirements document that is not linked to other engineering artifacts

Conducting a security review only at the end of each phase

Establishing a traceability process that links security requirements to design, implementation, verification, and disposal activities

Using a configuration management tool to track changes to the system

What is a key benefit of using model-based systems engineering (MBSE) for security engineering?

It eliminates the need for security testing

It replaces the need for threat modeling

It allows early analysis of security properties through simulation

It automatically generates secure code

What is the primary purpose of maintaining traceability between security requirements and test cases?

To document the system's architecture

To satisfy regulatory compliance only

To ensure each security requirement is verified by at least one test

To reduce the number of security tests needed

A systems engineering team is using MBSE to develop a new air traffic control system. The team needs to verify that the system meets security requirements, including resistance to denial-of-service (DoS) attacks. The team has a formal model of the system. Which approach provides the strongest evidence that the system is resistant to DoS attacks?

Waiting until the system is deployed and conducting a live DoS test

Running simulations of the model under various DoS attack scenarios and analyzing the system's response

Relying on the model's documentation to prove DoS resistance

Reviewing the model's architecture for potential DoS vulnerabilities

A company is developing a new web application that will be deployed on virtual machines in a cloud environment. The security team wants to gain confidence that the application's code is free from common vulnerabilities before deployment. Which assurance method is most appropriate for this purpose?

Dynamic application security testing (DAST) performed only after deployment

Static application security testing (SAST) integrated into the CI/CD pipeline

Penetration testing conducted by an external firm once a year

Reviewing the cloud provider's compliance certifications

Information Systems Security Engineering Professional

Domain 1Objective 3

Integrate with System Development Methodology ISSEP Practice Questions (Page 5)

Part of the Systems Security Engineering Foundations domain, which accounts for 24% of the ISSEP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~17–29 in this domain), expect 3–5 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

6concepts

24%of the exam

Questions 21–25

21application · medium
An organization is adopting ISO/IEC 24641:2023 to improve its systems engineering processes. The organization wants to ensure that security requirements are traceable from the concept phase through to disposal. Which process defined by the standard should be used to achieve this?
Select an answer first
22foundation · easy
What is a key benefit of using model-based systems engineering (MBSE) for security engineering?
Select an answer first
23foundation · easy
What is the primary purpose of maintaining traceability between security requirements and test cases?
Select an answer first
24expert · hard
A systems engineering team is using MBSE to develop a new air traffic control system. The team needs to verify that the system meets security requirements, including resistance to denial-of-service (DoS) attacks. The team has a formal model of the system. Which approach provides the strongest evidence that the system is resistant to DoS attacks?
Select an answer first
25application · medium
A company is developing a new web application that will be deployed on virtual machines in a cloud environment. The security team wants to gain confidence that the application's code is free from common vulnerabilities before deployment. Which assurance method is most appropriate for this purpose?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSEP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSEP” is a trademark of its owner, used for identification only.