Security Requirements Gathering CASEJAVA Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A Java-based healthcare portal stores patient records and is subject to HIPAA. During requirements gathering, the security lead interviews the compliance officer, reviews the organization's data-handling policy, and runs a threat model. Which requirement should be prioritized as the primary driver for the access-control design?

   • AThe development team's preference for using a lightweight authentication library to reduce coding effort
   • BThe compliance officer's statement that audit logs must capture who accessed which patient record
   • CThe threat model's identified risk of unauthorized access via broken session management
   • DThe existing network architecture that places the application behind a single firewall
   Reveal Solution Discussion Select an answer first
2. 47expert · hard

   A security architect is prioritizing security requirements for a Java-based application that will be used by multiple tenants. The threat model identifies a high-severity risk of cross-tenant data leakage and a medium-severity risk of denial-of-service. The business team wants to maximize feature velocity. Which requirement should be prioritized?

   • APrioritize feature development and address security later
   • BImplement strong tenant isolation controls to prevent data leakage
   • CPrioritize based on implementation effort rather than risk
   • DImplement rate limiting to mitigate denial-of-service
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   A security team is validating security requirements for a Java-based application that is subject to multiple regulations. The requirements have been documented, but the team is unsure whether they are complete. What is the most effective validation technique?

   • ARun a penetration test against the application
   • BCompare the requirements against a compliance checklist from each applicable regulation
   • CCheck that each requirement has a unique ID
   • DAsk stakeholders to review the requirements document
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   A project team wants to elicit security requirements by bringing together stakeholders from development, operations, and legal to discuss and reach consensus on security controls. Which elicitation technique is being used?

   • APrototyping
   • BQuestionnaire
   • CInterview
   • DWorkshop
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A mobile banking app team is eliciting security requirements. The stakeholders are geographically distributed and have limited availability. The security lead needs to gather input from all of them efficiently. Which elicitation technique is most appropriate?

   • AHold a single in-person workshop with all stakeholders
   • BDistribute a structured questionnaire and follow up with targeted interviews
   • CReview only the competitor's app features
   • DRely on the security team's assumptions without stakeholder input
   Reveal Solution Discussion Select an answer first