Security Quality Requirements Engineering (SQUARE) CASENET Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A .NET team is conducting a SQUARE risk assessment for a legacy application that will be modernized. They have limited time and must decide which risks to assess in detail. The application handles financial data and is subject to regulatory compliance. Which approach should the team take to ensure the risk assessment is effective within the time constraint?

   • AAssess all components equally to ensure no risk is overlooked.
   • BFocus the risk assessment on the components that handle financial data and are subject to compliance requirements.
   • CAssess only the risks that are easy to mitigate.
   • DSkip the risk assessment and rely on the development team's experience.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   In the SQUARE process, which step involves gathering information from stakeholders and existing system documentation to identify security needs?

   • AArtifact elicitation
   • BRequirements prioritization
   • CRisk assessment
   • DRequirements specification
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   In the SQUARE process, what is the purpose of the requirements prioritization step?

   • ATo assign a numerical score to each requirement based on its complexity
   • BTo eliminate all low-priority requirements from the project scope
   • CTo rank security requirements so that the most critical ones are addressed first
   • DTo translate business goals into technical security controls
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Which input is essential for conducting a risk assessment in the SQUARE process?

   • AThe final user acceptance test results
   • BThe system's source code
   • CA list of identified threats and vulnerabilities
   • DThe project's budget allocation
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A .NET development team is adopting SQUARE for a new project. They want to ensure that security requirements are addressed early in the SDLC to avoid costly rework. At which point in the SDLC should the team integrate SQUARE activities?

   • ADuring the deployment phase, just before the application goes live.
   • BDuring the testing phase, after the application is fully developed.
   • CDuring the maintenance phase, after the application has been in production.
   • DDuring the requirements gathering phase, before design and coding begin.
   Reveal Solution Discussion Select an answer first