Security Requirement Engineering (SRE) CASENET Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A multinational company is developing a .NET application that will process personal data of EU citizens. The product owner wants to minimize cost, the legal team requires GDPR compliance, and the marketing team wants to use the data for analytics. During elicitation, the legal team states that data must not leave the EU. Which requirement set is most appropriate?

   • AAnonymize all data before processing so GDPR does not apply.
   • BAsk the marketing team to stop using the data to avoid GDPR complexity.
   • CStore all data in the US to reduce costs, and rely on standard contractual clauses.
   • DDeploy the application in an EU region, implement data residency controls, and obtain explicit consent for analytics processing.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A .NET project has a security requirement that 'all user input must be sanitized.' After a penetration test, the team realizes that sanitization is breaking legitimate functionality, and the recommended fix is to use output encoding instead. How should the security lead manage this change?

   • AKeep the sanitization requirement and disable the broken functionality.
   • BUpdate the requirement to specify output encoding as the primary control, document the rationale, and update the traceability matrix.
   • CAsk the penetration testers to change their recommendation.
   • DRemove the requirement and rely on the penetration test results.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A financial services firm is building a .NET web application that will process credit card payments. The compliance team has mandated PCI DSS compliance, and the business wants to minimize customer friction during checkout. During security requirements elicitation, which approach best captures the necessary security requirements?

   • AInterview the compliance officer and the checkout product owner, then document requirements such as 'cardholder data must be encrypted in transit and at rest' and 'the checkout flow must not request unnecessary data'.
   • BAsk the development team to list all security features they think are useful, then implement them all to ensure maximum protection.
   • CCopy the security requirements from a similar project in another industry to save time and ensure completeness.
   • DWait until after the first release to collect security requirements based on actual user feedback.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security architect is writing security requirements for a .NET microservices architecture. The team needs requirements that are testable and unambiguous. Which requirement is the best example?

   • AAll services must log all security events.
   • BAll services must use secure authentication.
   • CAll services must authenticate each request using OAuth 2.0 with JWT bearer tokens.
   • DAll services must prevent unauthorized access.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which statement best describes the role of security requirement engineering in the software development lifecycle?

   • AIt is only necessary for applications that handle financial data
   • BIt is an ongoing process that informs design, development, testing, and maintenance
   • CIt is primarily concerned with post-release incident response and patch management
   • DIt is a one-time activity performed only during the requirements gathering phase
   Reveal Solution Discussion Select an answer first