What is the purpose of a Requirements Definition?

• A. Describes the application architecture.
• B. Defines deployment environments.
• C. Documents each function and security requirements that must be built into an application.
• D. Describes what will be tested in the application and how.

Answer: (C)

Defining requirements focuses on capturing what the system must do and what security controls must be built in. It explicitly documents the functions the application must provide and the security properties it must enforce, such as authentication, authorization, data protection, auditing, and input validation. This creates a clear baseline that guides design, development, and testing, and it helps stakeholders agree on scope and acceptance criteria.

Having these requirements written out up front ensures everyone understands the expected behavior and the security constraints, which supports traceability from business needs through implementation and verification. It prevents scope creep by keeping the team aligned on what must be delivered and validated.

Describing the architecture deals with how the system is structured, deployment environments specify where it runs, and outlining what will be tested pertains to the test plan or strategy. Those are separate artifacts; the requirements definition centers on what must be built, including the essential security requirements.