Security Quality Requirements Engineering (SQUARE) CASENET Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   During a SQUARE risk assessment for a .NET e-commerce site, the team identifies that a denial-of-service (DoS) attack on the login endpoint has a high likelihood but low impact, while a data breach of customer PII has low likelihood but very high impact. The team must decide which risk to address first. According to SQUARE, what should they do?

   • AIgnore both risks because they are not certain to occur.
   • BPrioritize the DoS risk because it is more likely to occur.
   • CPrioritize the data breach risk because the overall risk exposure is higher when impact is considered.
   • DTreat both risks equally because they are both security issues.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A project manager wants to ensure that the security requirements produced by SQUARE are actually implemented and verified. What should the team do to make the requirements actionable?

   • AWrite each requirement as a testable statement with acceptance criteria.
   • BPrioritize requirements but do not document them.
   • CStore requirements only in the project manager's notes.
   • DKeep requirements vague to allow flexibility during development.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A .NET team is eliciting security requirements for a new document management system. They have identified that the system will handle sensitive client data and must comply with data protection regulations. Which elicitation technique would be MOST effective for capturing compliance-related security requirements?

   • AReviewing applicable regulations and standards with the compliance officer.
   • BSurveying end users about their security preferences.
   • CBrainstorming with developers to list common security features.
   • DAnalyzing the system's source code for potential vulnerabilities.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   An organization is adopting a DevOps model with continuous delivery. They want to integrate SQUARE into their SDLC without slowing down releases. The security team is concerned that the full SQUARE process is too heavy for each iteration. What is the best way to integrate SQUARE while maintaining agility?

   • ASkip SQUARE and rely on automated security scanning in the CI pipeline.
   • BPerform a full SQUARE process at the project inception, then use lightweight security requirement reviews in each sprint.
   • CRun the full SQUARE process at the end of each sprint.
   • DUse a single SQUARE workshop at the end of the project to document requirements.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A .NET team is new to SQUARE and wants to adopt it for their next project. They have a limited budget and need to justify the investment to management. Which benefit of SQUARE should the team emphasize to gain management support?

   • ASQUARE guarantees compliance with all regulations.
   • BSQUARE speeds up the development process by reducing testing time.
   • CSQUARE eliminates all security risks in the application.
   • DSQUARE reduces the cost of fixing security issues by addressing them early in the SDLC.
   Reveal Solution Discussion Select an answer first