Which of the following is an example of a well-specified security requirement?

The system shall protect user data adequately

The system shall use strong encryption for all sensitive data

The system shall encrypt all passwords using AES-256 before storing them

The system shall use a secure login mechanism

During a security requirements walkthrough, the team discovers that the requirement 'all API responses must be encrypted' is not feasible because the API is publicly documented and responses are not sensitive. What is the best resolution?

Revise the requirement to specify encryption only for responses containing sensitive data, and document the rationale.

Keep the requirement as is and force the team to encrypt all responses.

Change the requirement to 'encrypt responses only when the client requests it.'

Delete the requirement entirely.

During security requirements elicitation, which of the following is a primary source for gathering security requirements?

The final deployment architecture and network diagrams

The marketing team's branding guidelines

The choice of programming language and framework

Stakeholder interviews and regulatory compliance standards

What is the purpose of security requirements validation?

To delete requirements that are not yet implemented

To ensure the requirements are complete, consistent, and feasible

To assign costs to each requirement

To implement the requirements in code

During a security requirements review for a .NET banking application, the team discovers that the requirement 'all user input must be validated' conflicts with the requirement 'the application must accept free-form text for customer feedback'. What is the most appropriate action during validation?

Escalate the conflict to the project sponsor for a business decision.

Remove the free-form text feature to eliminate the conflict.

Refine the input validation requirement to specify that free-form text is allowed but must be sanitized and length-limited.

Ignore the conflict and proceed with development, assuming the team will handle it.

EC-CouncilCertified Application Security Engineer (.NET)

Domain 2Objective 1

Security Requirement Engineering (SRE) CASENET Practice Questions (Page 2)

Part of the Security Requirements and Secure Design domain, which makes up ~21% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–17 in this domain), expect 2–2 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

6concepts

Questions 6–10

6foundation · easy
Which of the following is an example of a well-specified security requirement?
Select an answer first
7application · medium
During a security requirements walkthrough, the team discovers that the requirement 'all API responses must be encrypted' is not feasible because the API is publicly documented and responses are not sensitive. What is the best resolution?
Select an answer first
8foundation · easy
During security requirements elicitation, which of the following is a primary source for gathering security requirements?
Select an answer first
9foundation · easy
What is the purpose of security requirements validation?
Select an answer first
10application · medium
During a security requirements review for a .NET banking application, the team discovers that the requirement 'all user input must be validated' conflicts with the requirement 'the application must accept free-form text for customer feedback'. What is the most appropriate action during validation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASENET

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASENET” is a trademark of its owner, used for identification only.