Security Requirement Engineering (SRE) CASENET Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   During a security requirements walkthrough, the team finds that the requirement 'the system must lock out a user after 5 failed login attempts' conflicts with the requirement 'the system must not deny service to legitimate users'. What is the best way to resolve this conflict during validation?

   • AKeep both requirements as-is and let the development team decide.
   • BEscalate to the business owner to choose between security and availability.
   • CChange the lockout to a temporary lockout with exponential backoff.
   • DRemove the lockout requirement to avoid denying service.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard · select all that apply

   A .NET application is being developed for a university that handles student records. The stakeholders include the registrar's office, IT security, and student privacy advocates. During security requirements elicitation, which of the following are effective techniques for gathering comprehensive requirements? (Select all that apply.)

   • AConducting joint application design (JAD) sessions with all stakeholders.
   • BInterviewing a sample of students to understand their privacy expectations.
   • CUsing a standard security requirements checklist without customization.
   • DReviewing FERPA regulations and university privacy policies.
   Check answers Discussion Select an answer first
4. 13foundation · easy

   What is a key characteristic of a well-written security requirement specification?

   • AIt uses vague terms like 'strong' or 'adequate'
   • BIt is written only for the development team
   • CIt is testable and unambiguous
   • DIt describes implementation details rather than what the system must do
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A multinational company is developing a .NET application that will be deployed in multiple regions. The legal team has identified conflicting data residency requirements: the EU requires data to stay within the EU, while the US business unit wants data stored in the US for performance. During security requirements elicitation, what is the most effective approach?

   • ADocument both requirements and analyze the trade-offs, involving stakeholders from both regions to reach a consensus.
   • BAsk the legal team to resolve the conflict without involving other stakeholders.
   • CIgnore the US requirement and design for the EU only.
   • DChoose the EU requirement because it is more restrictive.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A .NET application is in the middle of development when a new regulation requires that all personal data be encrypted at rest. The team has already implemented a database that stores data in plaintext. What is the first step in managing this change to security requirements?

   • AAssess the impact of the new requirement on the existing design, schedule, and cost, then update the requirements document and traceability matrix.
   • BAsk the development team to encrypt the data without updating any documentation.
   • CImmediately implement encryption at rest in the current sprint.
   • DIgnore the new regulation until the next project phase.
   Reveal Solution Discussion Select an answer first