Security Quality Requirements Engineering (SQUARE) CASENET Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A .NET team has a list of security requirements with different risk scores, costs, and stakeholder importance. They need to decide which requirements to include in the first release. The project has a tight budget. What is the BEST approach to prioritize the requirements?

   • AInclude all requirements regardless of cost and risk.
   • BInclude only the requirements requested by the most stakeholders.
   • CRank requirements by risk score, then adjust based on cost and stakeholder needs.
   • DInclude only the requirements with the lowest implementation cost.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A .NET team is eliciting security requirements for a new application that will process personal data. They have a diverse group of stakeholders, including legal, IT, and business representatives. The team must ensure that the requirements are comprehensive and meet regulatory obligations. Which elicitation technique would be MOST effective in this complex environment?

   • AUse only a workshop with the IT team to gather technical requirements.
   • BUse only interviews with the legal team to ensure regulatory compliance.
   • CUse only a survey to gather requirements from all stakeholders.
   • DUse a combination of interviews, workshops, and artifact review to capture requirements from all perspectives.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A team is conducting a SQUARE process for a .NET health records system. They have completed artifact elicitation and risk assessment. What should they do next according to the SQUARE process?

   • ABegin coding the security features.
   • BPrioritize requirements before eliciting them.
   • CImmediately write the final security requirements specification.
   • DElicit security requirements from stakeholders based on the identified risks.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A healthcare startup is using SQUARE to define security requirements for a new .NET patient portal. The team has gathered stakeholders from clinical, legal, and IT. They need to elicit requirements that capture both regulatory obligations and practical user needs. Which elicitation technique would be most effective in this multi-stakeholder environment?

   • AFacilitated workshops with structured brainstorming and artifact review.
   • BAutomated scanning of the existing patient portal codebase.
   • CA review of the project schedule to identify security milestones.
   • DA single questionnaire sent only to the IT department.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   During a SQUARE risk assessment for a .NET banking application, the team identifies a critical vulnerability in the authentication module. The risk is rated as high likelihood and high impact. The team has limited resources and must decide which security requirements to include in the specification. What should the team do to ensure the most critical risk is addressed?

   • AAsk stakeholders to vote on which requirements they prefer.
   • BInclude all identified security requirements equally to ensure comprehensive coverage.
   • CPrioritize the security requirement that mitigates the high-risk authentication vulnerability.
   • DDefer the authentication requirement because it is complex and may delay the project.
   Reveal Solution Discussion Select an answer first