Security Requirements Gathering CASEJAVA Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   After documenting security requirements for a Java application, the team wants to validate that the requirements are complete and consistent. Which activity is most effective?

   • AAsk developers to estimate implementation effort for each requirement
   • BRun a static analysis tool on the existing codebase
   • CConfirm that each requirement has a unique ID
   • DReview the requirements against the threat model and regulatory checklists
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security lead is documenting security requirements for a Java-based microservices architecture. The requirements include authentication, authorization, and audit logging. The team needs to ensure that each requirement is testable and traceable. However, some requirements are vague, such as 'ensure secure communication.' How should the security lead document this requirement to make it testable?

   • AWrite the requirement as 'use encryption' without specifying the protocol
   • BDocument the requirement as a design principle without acceptance criteria
   • CSpecify that all service-to-service communication must use TLS 1.2 or higher with mutual authentication
   • DLeave the requirement as 'ensure secure communication' and let developers interpret it
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A Java-based application is being developed for a financial institution. The security team is gathering requirements from multiple sources: PCI DSS, the company's internal security policy, and a threat model. The threat model identifies a risk that is not covered by PCI DSS or the internal policy. What should the team do?

   • AAdd a security requirement to address the risk, even though it is not mandated by PCI DSS or policy
   • BIgnore the risk because it is not required by regulations or policy
   • CAsk the compliance officer to decide whether to add a requirement
   • DDocument the risk but do not add a requirement because it is not mandatory
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A Java-based payment application must meet PCI DSS and also support a business goal of minimizing transaction latency. The security team has gathered requirements including mandatory encryption of cardholder data and a requirement to keep transaction processing under 200 ms. The team must prioritize. What is the most appropriate approach?

   • ADrop the latency requirement because security is more important
   • BImplement encryption only for transactions over a certain amount to reduce latency
   • CPrioritize the latency requirement because it is a business goal and measurable
   • DPrioritize PCI DSS compliance and design the encryption to meet the latency target
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security team is validating security requirements for a Java application that must comply with PCI DSS. Which validation activity is most important to ensure regulatory alignment?

   • AMapping each requirement to a specific PCI DSS control
   • BChecking that requirements are written in a consistent style
   • CConfirming that requirements are prioritized by business impact
   • DEnsuring that requirements are stored in a version-controlled document
   Reveal Solution Discussion Select an answer first