Security Requirements Gathering CASEJAVA Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   During security requirements analysis for a Java application, the team identifies a requirement that is technically infeasible with the current architecture. What should the team do?

   • AIgnore the requirement because it is not feasible
   • BReject the requirement immediately
   • CInclude the requirement as-is and address it during implementation
   • DAnalyze the feasibility, document the constraint, and propose alternative approaches or architecture changes
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   A requirements analyst needs to gather security requirements from a large group of stakeholders distributed across different time zones. The goal is to collect a broad set of opinions efficiently. Which elicitation technique is most appropriate?

   • AQuestionnaire
   • BOne-on-one interview
   • CFacilitated workshop
   • DDocument analysis
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A security architect is prioritizing security requirements for a Java-based online payment system. The threat model identifies a critical vulnerability in the payment processing module, but fixing it requires a significant refactor that will delay the release by two months. The business team is concerned about missing a market opportunity. The architect must balance risk and business impact. Which action is most appropriate?

   • ARelease on schedule and fix the vulnerability in a later patch
   • BAsk the business team to cancel the release entirely
   • CDefer the fix and focus on less critical requirements to meet the deadline
   • DPrioritize the fix and communicate the risk trade-off to business stakeholders
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   During the validation of security requirements, the team checks that each requirement aligns with the organization's business objectives and applicable regulations. This activity is primarily ensuring that the requirements are:

   • AAligned with business and compliance needs
   • BPrioritized by cost
   • CTechnically feasible
   • DFree of any conflicts
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A security lead is eliciting security requirements for a Java-based system that will handle sensitive financial data. The stakeholders include the compliance officer, who emphasizes regulatory requirements, and the development team, who are concerned about implementation complexity. The lead needs to gather requirements that are both compliant and feasible. Which approach is most effective?

   • ASend a questionnaire to both groups and merge the responses
   • BRely on the security lead's expertise to define requirements
   • CConduct a workshop where both groups discuss trade-offs and jointly define requirements
   • DInterview the compliance officer first and then inform the development team
   Reveal Solution Discussion Select an answer first