Security Quality Requirements Engineering (SQUARE) CASENET Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   During a SQUARE risk assessment for a .NET application, the team identifies several risks. They have limited time and must focus on the most critical ones. Which factor should the team consider FIRST when prioritizing risks?

   • AThe ease of implementing a mitigation for each risk.
   • BThe cost to mitigate each risk.
   • CThe number of stakeholders affected by each risk.
   • DThe likelihood and impact of each risk.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A government agency is using SQUARE to define security requirements for a new .NET records management system. The risk assessment identified several high-risk threats, but the budget is tight. Stakeholders disagree on whether to fund a costly multi-factor authentication (MFA) requirement or a cheaper logging requirement. According to SQUARE, what should the team do to decide?

   • AAsk the system architect to decide based on technical preference.
   • BAlways choose the cheaper requirement to stay within budget.
   • CUse a prioritization method that weighs risk reduction against cost and stakeholder value.
   • DImplement both requirements without prioritization.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following is a typical output of the SQUARE methodology?

   • AA fully implemented security testing suite
   • BA completed threat model of the final system
   • CA detailed network architecture diagram
   • DA prioritized list of security requirements
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A .NET development team is completing the SQUARE process for a new customer-facing application. They have produced a list of security requirements and need to document them for the development team to implement. What should the team produce as the final output of SQUARE?

   • AA threat model document that lists all possible threats to the application.
   • BA security requirements specification that includes prioritized, testable requirements.
   • CA risk assessment report that details the likelihood and impact of each risk.
   • DA project plan that outlines the development timeline and milestones.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   In SQUARE, which factor is typically considered when prioritizing security requirements?

   • AThe number of lines of code needed to implement the requirement
   • BThe color scheme of the user interface
   • CThe programming language used for the project
   • DThe risk level associated with the requirement
   Reveal Solution Discussion Select an answer first