Abuse Case and Security Use Case Modeling CASENET Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   In security modeling, which statement correctly relates use cases and abuse cases?

   • AAbuse cases are derived from use cases by considering malicious actors and their goals
   • BAbuse cases and use cases are identical and can be used interchangeably
   • CUse cases are derived from abuse cases by removing all security controls
   • DUse cases are a subset of abuse cases that focus on user errors
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A security architect is integrating abuse and security use cases into a large, legacy system that is being modernized. The team has created a comprehensive set of abuse cases and security use cases. However, the project is behind schedule, and the business wants to cut scope. The architect must decide how to proceed. Which approach best balances security and project constraints?

   • AAsk the security team to perform a penetration test after the release to identify any missed security requirements.
   • BImplement all security use cases in the current iteration, even if it means delaying the release.
   • CDrop all security use cases from the current scope and add them to the backlog for the next release.
   • DPrioritize security use cases that address the highest-risk abuse cases and implement them in the current iteration; defer lower-risk ones to a future release with clear tracking.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A team has documented an abuse case: 'An attacker submits a specially crafted input to the search field to extract data from the database.' The team now needs to derive security use cases. Which set of security use cases best addresses this abuse case?

   • AValidate and sanitize all user input, parameterize database queries, and restrict database account privileges.
   • BImplement a CAPTCHA on the search form and rate-limit search requests.
   • CUse a web application firewall to block all requests containing the word 'SELECT'.
   • DEncrypt the database at rest and back up data daily.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A software architect is integrating security requirements into the design of a new banking application. The team has created abuse cases and corresponding security use cases. Which practice best ensures that these security requirements are actually addressed in the final system?

   • AAsk the security team to perform a penetration test after the application is deployed to identify any missed requirements.
   • BInclude the security use cases in the functional requirements document and trace them to design components, code modules, and test cases.
   • CKeep the abuse cases and security use cases in a separate security document for the auditors to review.
   • DCreate a security use case for every possible attack, regardless of likelihood, to ensure comprehensive coverage.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which of the following best describes the role of a security use case in system design?

   • AIt defines the system's user interface and navigation flow
   • BIt describes the system's hardware and network architecture
   • CIt specifies functional requirements that implement security controls to mitigate threats
   • DIt documents the system's error messages and logging format
   Reveal Solution Discussion Select an answer first