Security Quality Requirements Engineering (SQUARE) CASENET Practice Questions (Page 10)

Questions 46–49

1. 46foundation · easy

   During security requirements elicitation in SQUARE, which source provides information about the system's intended functionality and environment?

   • AThe firewall configuration log
   • BThe deployment script
   • CThe final security testing report
   • DSystem artifacts such as use cases and design documents
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   In the SQUARE methodology, what should be documented in the security requirements specification?

   • AThe names of all project stakeholders
   • BEach security requirement along with its priority and rationale
   • CThe complete source code of the application
   • DThe marketing strategy for the product
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A .NET team is using SQUARE to elicit security requirements for a new e-commerce application. They have access to the system architecture diagrams, data flow diagrams, and the threat model. They also have a diverse group of stakeholders including developers, business analysts, and security officers. Which elicitation technique would be MOST effective to gather a comprehensive set of security requirements from these artifacts and stakeholders?

   • ASend a survey to all stakeholders asking them to list any security features they think are needed.
   • BConduct structured interviews with each stakeholder group separately, using the artifacts as a basis for discussion.
   • CHave the security team alone review the artifacts and write the requirements without stakeholder input.
   • DUse a brainstorming session with only developers to generate technical security requirements.
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   A team is eliciting security requirements for a .NET application that will be deployed in multiple countries with varying data protection laws. Stakeholders include legal, marketing, and engineering. The legal team insists on strict data residency requirements, while marketing wants to minimize friction for users. Engineering is concerned about implementation complexity. How should the team elicit requirements that balance these conflicting needs?

   • ALet the legal team dictate all security requirements.
   • BLet the marketing team decide which requirements to include.
   • CUse facilitated workshops with all stakeholders to explicitly discuss trade-offs and document decisions.
   • DHave engineering implement the most technically elegant solution.
   Reveal Solution Discussion Select an answer first