Security Quality Requirements Engineering (SQUARE) CASENET Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A .NET team is eliciting security requirements for a new mobile banking app. They have a limited number of stakeholders available for interviews. Which technique would be MOST efficient to gather a broad set of security requirements from a diverse group of stakeholders?

   • ASend a questionnaire to stakeholders and collect written responses.
   • BConduct one-on-one interviews with each stakeholder separately.
   • CReview only the system architecture documents without stakeholder input.
   • DConduct a facilitated workshop with all stakeholders together.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A team is using SQUARE for a legacy .NET application modernization project. They have limited documentation and the original architects are gone. The team needs to elicit security requirements from the existing system. Which SQUARE step should they focus on first?

   • AArtifact elicitation to recover system architecture and data flows from the existing code and configuration.
   • BRequirements prioritization to rank security features.
   • CWriting the security requirements specification immediately.
   • DRisk assessment based solely on the technology stack.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A .NET team has produced a security requirements specification using SQUARE. The specification includes requirements that are not testable, and the development team is struggling to implement them. The project is at risk of delays. What is the BEST way to address this issue?

   • ARemove the untestable requirements from the specification.
   • BDefer the untestable requirements to a later release.
   • CRevise the requirements to make them testable and verifiable, involving the development team.
   • DAsk the development team to interpret the requirements as best they can.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   In the SQUARE methodology, what is the primary purpose of performing a risk assessment?

   • ATo select the specific security controls for the system
   • BTo identify and prioritize security risks that will inform the requirements
   • CTo verify that the implemented system meets all security requirements
   • DTo assign a monetary value to each business asset
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security team is performing a SQUARE risk assessment for a .NET application that integrates with several third-party APIs. The team has limited information about the security posture of these APIs. They need to produce a risk assessment that will inform security requirements. What is the best approach?

   • AExclude third-party APIs from the risk assessment because they are outside the organization's control.
   • BTreat the third-party APIs as potential risk sources and include them in the risk assessment with conservative assumptions.
   • CAssume the APIs are secure because they are provided by reputable vendors.
   • DDelay the risk assessment until full API documentation is available.
   Reveal Solution Discussion Select an answer first