Security Requirements Gathering CASEJAVA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   After gathering security requirements for a Java-based payment system, the security lead reviews them with stakeholders. The requirements include strong authentication, encryption of cardholder data, and audit logging. However, the business team notes that the audit logging requirement conflicts with their goal of minimizing storage costs. What is the best way to validate and resolve this conflict?

   • ADiscuss the trade-off with stakeholders and adjust the requirement to balance compliance and cost
   • BAsk the development team to implement logging without any retention limits
   • CRemove the audit logging requirement to satisfy the business team
   • DKeep the requirement unchanged and ignore the cost concern
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A security analyst is validating the security requirements for a Java-based application that will be deployed in a hybrid cloud environment. The requirements include encryption of data in transit, access control, and incident response. During validation, the analyst finds that the incident response requirement does not specify how logs will be aggregated across on-premises and cloud components. What is the best action?

   • ARemove the incident response requirement because it is too complex
   • BKeep the requirement as-is and assume logs will be available
   • CAsk the cloud provider to handle all incident response
   • DRefine the requirement to specify log aggregation across all environments
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security analyst is validating security requirements for a Java-based healthcare system. The requirements include role-based access control (RBAC) and audit logging. During validation, the analyst discovers that the audit logging requirement conflicts with the RBAC requirement because logs would expose sensitive patient data to auditors who lack appropriate roles. What is the best action?

   • AKeep both requirements and document the conflict for later resolution
   • BEncrypt the audit logs so that only the system administrator can read them
   • CRemove the audit logging requirement to protect patient privacy
   • DModify the RBAC requirement to grant auditors a special role that allows access to logs
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   A security requirement is documented as: 'The application must encrypt all data at rest using AES-256.' What is the PRIMARY benefit of documenting the requirement in this specific, measurable way?

   • AIt eliminates the need for security testing
   • BIt guarantees the application will be secure
   • CIt makes the requirement easier to ignore
   • DIt enables traceability from design to implementation and testing
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A multinational company is developing a Java application that handles personal data of users in multiple countries. The security team must identify all applicable security requirements. Which approach is most appropriate?

   • AApply only the strictest regulation globally
   • BUse only the company's internal security policy
   • CReview data protection regulations from each country, internal policies, and threat models
   • DRely on the development team's knowledge of security
   Reveal Solution Discussion Select an answer first