A Java-based application is being developed for a government agency. The security analyst must gather security requirements. Which source is most likely to provide mandatory security controls?

The project manager's risk appetite statement

The agency's business continuity plan

The agency's security policy and applicable government regulations

The development team's preferred framework documentation

A financial services firm is gathering security requirements for a new Java-based trading application. Stakeholders include traders, compliance officers, and IT operations. The security analyst needs to elicit requirements efficiently while ensuring all stakeholder groups contribute. Which technique is most appropriate?

Send a questionnaire to all stakeholders and compile the responses

Review the existing codebase and infer security requirements from past vulnerabilities

Facilitate a joint requirements workshop with representatives from each stakeholder group

Conduct a series of one-on-one interviews with each stakeholder group

A retail company is prioritizing security requirements for its new e-commerce platform. The threat model shows a high-severity risk of SQL injection in the search feature, while a low-severity risk of verbose error messages is also identified. The business wants to release the platform quickly. Which requirement should be prioritized first?

Implement parameterized queries to prevent SQL injection

Suppress detailed error messages to avoid information leakage

Prioritize requirements based on ease of implementation rather than risk

Defer all security requirements to meet the release deadline

A security analyst is eliciting security requirements for a Java-based online banking system. The stakeholders are geographically distributed and have limited availability. Which technique is most efficient for gathering initial input from a large number of stakeholders?

Code review of the existing system

EC-CouncilCertified Application Security Engineer (Java)

Domain 2Objective 1

Security Requirements Gathering CASEJAVA Practice Questions (Page 5)

Part of the Security Requirements and Secure Design domain, which makes up ~19% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–5 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

5concepts

Questions 21–25

21foundation · easy
Which characteristic is ESSENTIAL for a well-documented security requirement?
Select an answer first
22application · easy
A Java-based application is being developed for a government agency. The security analyst must gather security requirements. Which source is most likely to provide mandatory security controls?
Select an answer first
23application · medium
A financial services firm is gathering security requirements for a new Java-based trading application. Stakeholders include traders, compliance officers, and IT operations. The security analyst needs to elicit requirements efficiently while ensuring all stakeholder groups contribute. Which technique is most appropriate?
Select an answer first
24application · medium
A retail company is prioritizing security requirements for its new e-commerce platform. The threat model shows a high-severity risk of SQL injection in the search feature, while a low-severity risk of verbose error messages is also identified. The business wants to release the platform quickly. Which requirement should be prioritized first?
Select an answer first
25application · medium
A security analyst is eliciting security requirements for a Java-based online banking system. The stakeholders are geographically distributed and have limited availability. Which technique is most efficient for gathering initial input from a large number of stakeholders?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASEJAVA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASEJAVA” is a trademark of its owner, used for identification only.

Security Requirements Gathering CASEJAVA Practice Questions (Page 5)

Questions 21–25

Which characteristic is ESSENTIAL for a well-documented security requirement?

A Java-based application is being developed for a government agency. The security analyst must gather security requirements. Which source is most likely to provide mandatory security controls?

A security analyst is eliciting security requirements for a Java-based online banking system. The stakeholders are geographically distributed and have limited availability. Which technique is most efficient for gathering initial input from a large number of stakeholders?

Keep studying — Security Requirements and Secure Design