A Java-based SaaS application processes personal data of EU citizens. The security team is gathering requirements. Which source is most likely to impose mandatory requirements on data handling?

The company's internal coding standards

The development team's threat model

The marketing department's feature roadmap

A healthcare startup is building a Java-based patient portal that will store personal health information. During the requirements-gathering phase, the security lead interviews the compliance officer, reviews the organization's internal data-handling policy, and runs a threat-modeling session with the architecture team. Which set of inputs should be consolidated as the authoritative source for security requirements?

The internal data-handling policy, because it already encodes all security controls

Only the compliance officer's interview notes, since they reflect legal obligations

The threat-model outputs alone, because they identify all exploitable weaknesses

Regulatory statutes, internal policies, and threat-model outputs

A security analyst is documenting security requirements for a Java-based e-commerce application. Which format best supports testability and traceability?

A requirements table with unique IDs, priority, source, and testable acceptance criteria

A list of security controls with vague descriptions such as 'strong encryption'

A set of UML diagrams showing system architecture

A narrative paragraph describing the desired security posture

A multinational company is developing a Java-based application that processes personal data in multiple jurisdictions. The security team is gathering requirements. They must balance GDPR compliance, local data residency laws, and the business need for a centralized global database. What is the most appropriate approach?

Avoid processing personal data in jurisdictions with strict laws

Store all data in the cloud without regard to location because GDPR allows transfers

Use a single centralized database in the company's headquarters country and apply GDPR globally

Deploy regional databases that comply with local data residency laws and implement GDPR-compliant data transfer mechanisms

A project team is eliciting security requirements for a new Java-based health record system. The stakeholders include doctors, nurses, IT staff, and patients. The team wants to ensure that all user groups' security needs are captured. Which elicitation technique is most suitable?

Rely on the IT team's assumptions about user needs

Use only a generic questionnaire sent to all users

Hold one joint workshop with all user groups

Conduct separate interviews with representatives from each user group

EC-CouncilCertified Application Security Engineer (Java)

Domain 2Objective 1

Security Requirements Gathering CASEJAVA Practice Questions (Page 7)

Part of the Security Requirements and Secure Design domain, which makes up ~19% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–5 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

5concepts

Questions 31–35

31application · easy
A Java-based SaaS application processes personal data of EU citizens. The security team is gathering requirements. Which source is most likely to impose mandatory requirements on data handling?
Select an answer first
32application · medium
A healthcare startup is building a Java-based patient portal that will store personal health information. During the requirements-gathering phase, the security lead interviews the compliance officer, reviews the organization's internal data-handling policy, and runs a threat-modeling session with the architecture team. Which set of inputs should be consolidated as the authoritative source for security requirements?
Select an answer first
33application · medium
A security analyst is documenting security requirements for a Java-based e-commerce application. Which format best supports testability and traceability?
Select an answer first
34expert · hard
A multinational company is developing a Java-based application that processes personal data in multiple jurisdictions. The security team is gathering requirements. They must balance GDPR compliance, local data residency laws, and the business need for a centralized global database. What is the most appropriate approach?
Select an answer first
35application · medium
A project team is eliciting security requirements for a new Java-based health record system. The stakeholders include doctors, nurses, IT staff, and patients. The team wants to ensure that all user groups' security needs are captured. Which elicitation technique is most suitable?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASEJAVA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASEJAVA” is a trademark of its owner, used for identification only.

Security Requirements Gathering CASEJAVA Practice Questions (Page 7)

Questions 31–35

A Java-based SaaS application processes personal data of EU citizens. The security team is gathering requirements. Which source is most likely to impose mandatory requirements on data handling?

A security analyst is documenting security requirements for a Java-based e-commerce application. Which format best supports testability and traceability?

A project team is eliciting security requirements for a new Java-based health record system. The stakeholders include doctors, nurses, IT staff, and patients. The team wants to ensure that all user groups' security needs are captured. Which elicitation technique is most suitable?

Keep studying — Security Requirements and Secure Design