Security Quality Requirements Engineering (SQUARE) CASENET Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A .NET team is using SQUARE for a project with a tight schedule. They have completed the risk assessment and elicited requirements. Now they need to prioritize the requirements. The team is divided on whether to prioritize based on risk or based on stakeholder needs. What is the BEST approach?

   • APrioritize solely based on risk to ensure security is maximized.
   • BPrioritize based on the order in which requirements were elicited.
   • CPrioritize solely based on stakeholder needs to ensure user satisfaction.
   • DUse risk as the primary factor, but adjust for stakeholder needs and cost.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An e-commerce company is applying SQUARE to a new .NET order-processing system. The risk assessment reveals that a SQL injection vulnerability in the search feature would have high impact on customer data, while a cross-site scripting issue in the admin panel would have moderate impact. The team has limited development resources. According to SQUARE, how should they prioritize the resulting security requirements?

   • APrioritize the SQL injection requirement higher because it addresses a higher-risk vulnerability.
   • BTreat both requirements equally regardless of risk.
   • CPrioritize the XSS requirement higher because it is easier to fix.
   • DDefer both requirements until after the system is deployed.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A .NET team has completed the SQUARE process and produced a security requirements specification. They want to ensure that the requirements are actionable for the development team. What characteristic should the requirements have?

   • AThey should be vague to allow flexibility in implementation.
   • BThey should be prioritized by the development team after implementation.
   • CThey should be written in technical jargon only.
   • DThey should be testable and verifiable.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Why is it important to integrate SQUARE early in the SDLC?

   • ATo satisfy the requirement for a security audit after deployment
   • BTo identify security requirements before design and implementation, reducing costly rework
   • CTo ensure that the system is deployed without any security testing
   • DTo replace the need for any security controls in the final system
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which document is a primary output of the SQUARE process?

   • ADeployment guide
   • BUser manual
   • CSecurity requirements specification
   • DTest plan
   Reveal Solution Discussion Select an answer first