Security Requirements Gathering CASEJAVA Practice Questions (Page 6)

Questions 26–30

1. 26application · easy

   A security analyst is writing security requirements for a Java-based API. Which requirement statement is most testable?

   • AThe API must prevent unauthorized access
   • BThe API should use strong encryption
   • CThe API must be secure
   • DThe API must reject requests with invalid authentication tokens with a 401 status code
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A security consultant is gathering security requirements for a Java-based application that will be deployed in a public cloud environment. The client is subject to GDPR and also has internal policies requiring encryption of data at rest. The consultant must identify all relevant sources. Which combination of sources is most appropriate?

   • AOnly the internal encryption policy
   • BOnly the cloud provider's security documentation
   • COnly GDPR regulations, since they are legally binding
   • DGDPR regulations, internal encryption policies, and cloud-specific threat models
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security analyst is validating the security requirements for a Java-based e-commerce site. The requirements include PCI-DSS compliance, encryption of customer data, and a custom authentication scheme. During validation, the analyst discovers that the custom authentication scheme does not meet PCI-DSS requirements. What should the analyst do?

   • ARevise the authentication requirement to align with PCI-DSS standards
   • BAsk the business team to change their business model
   • CRemove the encryption requirement to simplify the system
   • DKeep the custom scheme and ignore PCI-DSS
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A security analyst is eliciting security requirements for a Java-based application in a large enterprise. The stakeholders have conflicting priorities: the security team wants strict controls, the business wants rapid feature delivery, and operations wants minimal downtime. The analyst must gather requirements that are feasible and aligned. Which approach is most effective?

   • AConduct a series of workshops to negotiate and prioritize requirements across stakeholder groups
   • BAdopt the security team's requirements because security is the top priority
   • CUse a questionnaire to collect requirements and then let the security team decide priorities
   • DInterview each stakeholder group separately and compile a list of all requirements
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   During security requirements analysis for a Java web application, the team identifies two requirements: (1) mandatory two-factor authentication for all users, and (2) a frictionless login experience to maximize user adoption. These requirements conflict. What is the best approach to resolve this conflict?

   • ADrop the two-factor authentication requirement to preserve user experience
   • BPrioritize the two-factor authentication requirement because security requirements typically override usability preferences
   • CImplement two-factor authentication only for administrative users and leave regular users unaffected
   • DConduct a risk assessment to determine the business impact of a breach versus the impact of reduced usability
   Reveal Solution Discussion Select an answer first