Security Requirements Gathering CASEJAVA Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A software team is documenting security requirements for a Java web application. They want to ensure each requirement can be verified during testing and traced back to a business need. Which documentation format best meets this goal?

   • AA requirement statement with a unique ID, acceptance criteria, and a reference to its source
   • BA set of generic security best practices copied from a template
   • CA list of security controls without linking them to specific threats
   • DA narrative paragraph describing the desired security posture
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   During the security requirements gathering phase for a Java-based web application, the team identifies the need to comply with the General Data Protection Regulation (GDPR) and the Payment Card Industry Data Security Standard (PCI DSS). Which category of security requirements source do these represent?

   • ARegulations and standards
   • BStakeholder interviews
   • CThreat modeling outputs
   • DBusiness policies
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A government contractor is developing a Java application that processes classified data. The project manager wants to identify all applicable security requirements sources. Which combination of sources is most relevant for this project?

   • AGovernment regulations, internal security policies, and threat modeling
   • BThe project manager's personal experience and preferences
   • CIndustry best practices and public standards only
   • DOnly the security team's threat model
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   A security team is reviewing the documented security requirements to ensure they are complete and do not contradict each other. Which validation criterion are they applying?

   • AConsistency
   • BTraceability
   • CCompleteness
   • DFeasibility
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A security team is analyzing security requirements for a Java-based system. They have a limited budget and must choose between implementing a high-cost control that addresses a low-probability, high-impact threat and a low-cost control that addresses a high-probability, low-impact threat. What is the best prioritization approach?

   • AImplement both controls if the budget allows, otherwise defer both
   • BImplement the low-cost control because it addresses a high-probability threat
   • CCalculate the risk score (likelihood × impact) for each and prioritize the control that reduces the most risk per unit of cost
   • DImplement the high-cost control because the impact is high
   Reveal Solution Discussion Select an answer first