Security Requirements Gathering CASEJAVA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A development team is documenting security requirements for a Java-based API. They need to ensure that each requirement can be tested and that the implementation can be verified. Which documentation practice is most effective?

   • ADocument requirements only in code comments
   • BDescribe requirements in a high-level design document without details
   • CWrite each requirement with measurable acceptance criteria and a unique identifier
   • DUse a single paragraph to list all security controls
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   During security requirements analysis, the team identifies a requirement that would significantly increase development time and cost. They must decide whether to include it in the current release. Which factor should be the PRIMARY basis for prioritizing this requirement?

   • ANumber of stakeholders requesting it
   • BPersonal preference of the project manager
   • CEase of implementation
   • DBusiness impact and threat severity
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   A security analyst is compiling a list of security requirements for a new Java application. The list includes items such as 'All users must authenticate using multi-factor authentication' and 'Access to customer data must be logged.' Which source of security requirements is most likely to produce these specific requirements?

   • ARegulatory compliance
   • BIndustry standards
   • CThreat modeling
   • DBusiness policies
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security lead is documenting security requirements for a Java-based application that must comply with multiple regulations. The team has gathered requirements from various sources, but some are conflicting. The lead needs to create a document that supports validation and traceability. Which approach is most effective?

   • ACreate a requirements traceability matrix linking each requirement to its source and acceptance criteria
   • BDocument requirements only in meeting minutes
   • CWrite a single narrative document describing all requirements
   • DList requirements in a spreadsheet without source references
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   A security analyst is analyzing a set of security requirements and finds that one requirement conflicts with another: one demands maximum data retention for auditing, while another requires data minimization for privacy. What is the FIRST step the analyst should take?

   • AImplement both requirements as-is
   • BPrioritize the requirement from the higher-paying stakeholder
   • CIdentify the conflict and consult stakeholders to resolve it
   • DRemove both conflicting requirements
   Reveal Solution Discussion Select an answer first