Security Quality Requirements Engineering (SQUARE) CASENET Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A .NET development team is starting a new project for a healthcare portal. The security lead wants to use SQUARE to ensure security requirements are captured early. The team has limited time and budget. Which SQUARE step should the team perform FIRST to ensure the subsequent requirements elicitation is focused on the most critical assets?

   • APerform a risk assessment to identify high-value assets and threats before eliciting requirements.
   • BDocument the security requirements specification before engaging stakeholders.
   • CPrioritize requirements based on cost and stakeholder needs before any risk analysis.
   • DElicit requirements from all stakeholders immediately to capture every possible security need.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A development team is adopting SQUARE for a new .NET microservices project. They want to ensure security requirements are addressed early and not retrofitted. At which point in the SDLC should the SQUARE process be integrated?

   • ADuring the requirements and design phase, before coding begins.
   • BDuring the testing phase, after the code is written.
   • CDuring maintenance, after the first security incident.
   • DDuring deployment, just before production release.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company is considering whether to adopt SQUARE for a small, internal .NET tool with limited security exposure. The team is concerned about the overhead of the full SQUARE process. What is the most appropriate recommendation?

   • ASkip SQUARE entirely because the tool is internal.
   • BUse a scaled-down version of SQUARE, focusing on risk assessment and a short requirements list.
   • CRun the full SQUARE process to be thorough.
   • DUse only the prioritization step of SQUARE.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A .NET team has identified a set of security requirements for a new application. The risk assessment shows that the highest-risk requirement is also the most expensive to implement. The project has a fixed budget and a tight deadline. The stakeholders are divided: some want to include the expensive requirement, others want to defer it to a later release. What is the BEST decision for the team?

   • ADefer the high-risk requirement to the next release to stay within budget.
   • BInclude the high-risk requirement in the current release and defer lower-risk requirements to manage budget.
   • CAsk the stakeholders to vote on whether to include the requirement.
   • DInclude all requirements regardless of cost to ensure comprehensive security.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A team has completed SQUARE for a .NET application and produced a prioritized list of security requirements. During implementation, a new critical vulnerability is discovered in a third-party library used by the application. The team must decide whether to add a new requirement to address this vulnerability, potentially displacing a previously prioritized requirement. What should they do?

   • AIgnore the new vulnerability because it was not in the original risk assessment.
   • BAdd the new requirement without changing existing priorities.
   • CRe-run the risk assessment and re-prioritize requirements to incorporate the new vulnerability.
   • DRemove the lowest-priority requirement without reassessment.
   Reveal Solution Discussion Select an answer first