Security Quality Requirements Engineering (SQUARE) CASENET Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A large enterprise is applying SQUARE to a .NET customer relationship management (CRM) system. The risk assessment team is split: one group wants to use a quantitative risk model (e.g., annualized loss expectancy), while another prefers a qualitative model (e.g., high/medium/low). The system handles sensitive customer data and the organization has a low risk tolerance. The team must choose an approach that will produce defensible prioritization for the security requirements. What should they do?

   • AUse only qualitative because it is faster and easier.
   • BUse a hybrid approach: qualitative for initial screening and quantitative for high-priority items.
   • CUse only quantitative because it produces precise numbers.
   • DLet the project sponsor choose the model arbitrarily.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A development team has produced a set of security requirements using SQUARE for a .NET application. The risk assessment shows that requirement R1 (encrypt all data at rest) has high risk reduction but high implementation cost, while R2 (implement audit logging) has moderate risk reduction and low cost. The budget allows only one to be implemented in the current sprint. Stakeholders are divided. According to SQUARE's prioritization principles, what is the most defensible decision?

   • AAlways choose the cheaper requirement to stay within budget.
   • BAlways choose the requirement with higher risk reduction, regardless of cost.
   • CUse a prioritization technique like the Analytic Hierarchy Process (AHP) to weigh risk reduction, cost, and stakeholder value.
   • DDefer both requirements until the next budget cycle.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A .NET team is working on a project that is already in the design phase. They have not yet conducted SQUARE, and the project manager is concerned about adding delays. However, the team has identified several security concerns that could affect the architecture. What is the BEST course of action?

   • AWait until the design is complete and then conduct a full SQUARE process.
   • BConduct a lightweight SQUARE exercise focusing on the identified security concerns before design is finalized.
   • CConduct a full SQUARE process with all steps, regardless of the delay.
   • DSkip SQUARE and rely on security testing during the testing phase.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A small software company is new to SQUARE and wants to adopt it for a .NET project. They have a small team and a tight schedule. What is the primary benefit of using SQUARE in this context?

   • AIt speeds up the development process by skipping risk assessment.
   • BIt helps identify security requirements early, reducing costly rework later.
   • CIt eliminates the need for security testing.
   • DIt guarantees the application will have no vulnerabilities.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   After completing SQUARE for a .NET application, the team has a security requirements specification with 50 requirements. The development team complains that the specification is too long and they don't know which requirements are essential for the first release. What should the team do to make the specification more actionable?

   • ARemove all low-priority requirements from the specification.
   • BRewrite the specification in simpler language.
   • CAsk the development team to implement all 50 requirements in the first release.
   • DCreate a prioritized subset of requirements for the first release, with traceability to the full specification.
   Reveal Solution Discussion Select an answer first