Abuse Case and Security Use Case Modeling CASENET Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A security architect is creating an abuse case diagram for a system that has multiple user roles. The diagram currently shows a normal use case 'Approve invoice' and an abuse case 'Unauthorized user approves an invoice.' The architect wants to show that the abuse case is only possible if the attacker has a specific role. How should the architect model this in the UML diagram?

   • ACreate a separate actor for the attacker with the specific role, and connect it to the abuse case with an association.
   • BPlace the abuse case inside a subsystem that represents the role's permissions.
   • CUse a generalization relationship between the abuse case and the normal use case.
   • DAdd a note to the abuse case that says 'requires role: approver'.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A security architect is creating an abuse case diagram for a new IoT management platform. The platform has a 'Remote Firmware Update' use case. The architect wants to show that an attacker could intercept and modify the firmware update. Which diagram element best represents this threat?

   • AAn 'Attacker' actor connected directly to the 'Remote Firmware Update' use case without a misuse case.
   • BA security use case 'Verify Firmware Signature' connected to the 'Remote Firmware Update' use case.
   • CA class diagram showing the firmware update process.
   • DA misuse case 'Tamper with Firmware Update' connected to the 'Remote Firmware Update' use case, with an 'Attacker' actor.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   What is a key benefit of integrating security use cases into the system design process?

   • AIt automatically generates secure code
   • BIt removes the need for user authentication
   • CIt guarantees that the system will be completely immune to all attacks
   • DIt ensures that security controls are considered early in the development lifecycle
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A team is using abuse case modeling for a new online voting system. They have identified an abuse case where an attacker can vote multiple times by creating multiple accounts. The team needs to define a security use case. The system must also allow legitimate users to vote without unnecessary friction. Which security use case best balances security and usability?

   • ARequire email verification for each account, and limit one vote per verified email.
   • BRequire a unique government-issued ID for each voter, verified during registration.
   • CAllow multiple accounts but limit each account to one vote per election.
   • DUse device fingerprinting to detect and block multiple accounts from the same device.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   How are security use cases typically derived from abuse cases?

   • ABy duplicating the abuse case as a functional requirement
   • BBy removing all security features from the system
   • CBy identifying the countermeasures and security controls that would prevent the abuse
   • DBy ignoring the abuse case and focusing on user convenience
   Reveal Solution Discussion Select an answer first