Security Requirements Gathering CASEJAVA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A financial services firm is gathering security requirements for a new Java-based transaction system. Stakeholders include the compliance team, developers, and operations staff, who have conflicting priorities. The security lead wants to elicit requirements efficiently while ensuring all perspectives are captured. Which approach is most effective?

   • AConduct a structured workshop with representatives from each stakeholder group
   • BSend a questionnaire to all stakeholders and compile the responses
   • CInterview only the compliance team because they define legal requirements
   • DReview the existing system's documentation and skip stakeholder input
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A startup is building a social media platform and has gathered security requirements from various sources. The threat model identifies a high-risk vulnerability in user authentication, while a business policy requires minimal user friction. The team must prioritize requirements. Which requirement should be addressed first?

   • ADefer all security requirements until after launch
   • BStrengthen the authentication mechanism despite potential user friction
   • CImplement only the easiest security controls
   • DPrioritize the business policy to minimize user friction
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security analyst is validating the security requirements for a Java-based application that processes credit card data. The requirements include encryption of cardholder data, access control, and audit logging. During validation, the analyst finds that the audit logging requirement does not specify retention duration, which conflicts with the company's data minimization policy. What is the best course of action?

   • AWork with stakeholders to define a retention period that satisfies both compliance and data minimization
   • BRemove the audit logging requirement to comply with data minimization
   • CKeep the requirement as-is and ignore the data minimization policy
   • DSet an indefinite retention period to ensure all logs are available
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security analyst is eliciting security requirements for a Java-based mobile banking app. The stakeholders include security experts, UX designers, and product managers. The analyst wants to identify conflicting requirements early. Which technique is best?

   • AA questionnaire sent to all stakeholders
   • BA threat modeling session with only security experts
   • CA review of the existing codebase
   • DA facilitated workshop where stakeholders discuss and resolve conflicts
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security analyst is documenting security requirements for a Java-based system. The requirements were gathered from multiple stakeholders and include conflicting statements. What is the best way to document these requirements to support validation?

   • ADocument each requirement with its source, priority, and acceptance criteria, and flag conflicts for resolution
   • BDocument requirements in a single narrative to avoid highlighting conflicts
   • CDocument requirements without sources to avoid blame
   • DDocument only the requirements that are agreed upon by all stakeholders
   Reveal Solution Discussion Select an answer first