Abuse Case and Security Use Case Modeling CASENET Practice Questions (Page 1)

Questions 1–5

1. 1application · easy

   During a design review, a developer says, 'We already have a use case for user login, so we don't need an abuse case for it.' Which response best clarifies the difference?

   • AUse cases are for functional requirements; abuse cases are for non-functional requirements like performance.
   • BUse cases describe what the system should do; abuse cases describe how an attacker could misuse the system.
   • CUse cases are for external users; abuse cases are for internal users.
   • DUse cases are written by developers; abuse cases are written by testers.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   During a threat modeling workshop, the team identified an abuse case where an attacker could intercept and modify a customer's order details during transmission. The team needs to document a functional requirement that directly mitigates this threat. Which of the following best represents a security use case?

   • AThe system shall use a load balancer to distribute traffic across multiple servers.
   • BThe system shall log all failed login attempts for audit purposes.
   • CThe system shall allow administrators to view all active user sessions.
   • DThe system shall encrypt all order data in transit using TLS 1.2 or higher.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security analyst is creating abuse cases for a new online payment system. The team has a use case diagram. Which sequence of steps best follows the abuse case creation process?

   • AList all security controls, then create use cases for each control.
   • BIdentify malicious actors, determine their goals, then map misuse scenarios to each use case.
   • CDraw a class diagram, then convert every class into an abuse case.
   • DWrite the abuse cases first, then create the use cases to match them.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   When deriving a security use case from an abuse case, what should be specified?

   • AThe user interface design for the system
   • BThe system's performance and scalability requirements
   • CThe security controls and behaviors that mitigate the identified threat
   • DThe exact steps an attacker would take to exploit the system
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A team is modeling threats for an e-commerce application. They want to visualize how an attacker could misuse the 'Place Order' use case. Which UML-style diagram is most appropriate?

   • AA class diagram with all entities and their relationships.
   • BA sequence diagram showing the order of messages between the user and the system.
   • CA deployment diagram showing hardware and software nodes.
   • DAn abuse case diagram with the attacker as an actor and misuse cases connected to the use case.
   Reveal Solution Discussion Select an answer first