Security Requirement Engineering (SRE) CASENET Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A .NET application is in production when a new security requirement is introduced: all sessions must expire after 15 minutes of inactivity. The current session timeout is 60 minutes. The change will affect user experience and may require updates to the session management module. What is the most appropriate change management process?

   • AImmediately change the session timeout in the configuration file and deploy.
   • BChange the timeout to 15 minutes but do not update any documentation.
   • CAssess the impact on users and the session management module, then update the requirements and plan a controlled rollout.
   • DIgnore the new requirement because the application is already in production.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which activity is part of security requirements elicitation?

   • AWriting unit tests for authentication logic
   • BReviewing code for SQL injection vulnerabilities
   • CDeploying the application to a production server
   • DConducting interviews with stakeholders to identify assets and threats
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A project manager at a software company asks the security team to start defining security requirements for a new .NET application. The project is currently in the requirements gathering phase. Which statement best describes the role of Security Requirement Engineering (SRE) in this context?

   • ASRE is an ongoing process that integrates security considerations into the requirements, design, implementation, and testing phases.
   • BSRE is only needed for applications that handle sensitive data.
   • CSRE is the same as threat modeling and should be performed only by security experts.
   • DSRE is a one-time activity performed at the start of the project to list all security features.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   When analyzing security requirements, which factor is most important for prioritizing them?

   • AThe preference of the development team lead
   • BThe order in which requirements were elicited
   • CThe number of lines of code needed to implement it
   • DThe severity of the risk the requirement mitigates
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A government contractor is developing a .NET application that will handle classified data. The project manager asks the security team to 'just include all security requirements from the last project.' Which approach is most appropriate?

   • AAsk the project manager to define the requirements.
   • BCopy the previous requirements verbatim to save time.
   • CReuse the previous requirements as a starting point, then elicit and tailor them to the current project's data classification and regulatory context.
   • DStart from scratch and ignore the previous requirements.
   Reveal Solution Discussion Select an answer first