Security Requirement Engineering (SRE) CASENET Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A .NET team is eliciting security requirements for an e-commerce application. Stakeholders propose: (1) mandatory MFA for all users, (2) PCI-DSS compliance for payment processing, (3) a custom CAPTCHA to reduce bot traffic, and (4) a 'remember me' feature for convenience. The budget is limited. Which requirement should be prioritized first?

   • ACustom CAPTCHA to reduce bot traffic
   • BPCI-DSS compliance for payment processing
   • CMandatory MFA for all users
   • D'Remember me' feature for convenience
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   During a security requirements review, a developer points out that the requirement 'All passwords must be hashed with a strong algorithm' conflicts with the legacy authentication module that only supports MD5. What is the best action for the security lead?

   • ADocument the conflict and schedule a walkthrough to decide whether to upgrade the legacy module or revise the requirement.
   • BApprove the requirement and instruct the developer to implement it anyway.
   • CChange the requirement to 'use MD5' to match the legacy module.
   • DRemove the requirement to avoid delaying the project.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A government agency is procuring a new .NET system that will handle citizen data. They have identified stakeholders including privacy officers, IT security, and end-users. During elicitation, which technique is most effective for uncovering implicit security expectations?

   • AUsing a checklist of common security requirements from industry standards.
   • BSending a survey to all potential users asking them to list security features they want.
   • CReviewing only the legal and regulatory documents to extract requirements.
   • DConducting structured interviews with each stakeholder group, using scenarios and probing questions.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A .NET development team is writing security requirements for a new e-commerce application. Which of the following is the best example of a well-specified security requirement?

   • AThe application must reject any password that is less than 12 characters long and must not contain the user's username.
   • BAll passwords must be stored using a strong hashing algorithm.
   • CThe system must use HTTPS for all data transmission.
   • DThe application must be secure against common attacks.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   During security requirements validation, the team finds that a requirement for 'real-time fraud detection' conflicts with the existing architecture that processes transactions in batch overnight. The business wants real-time detection, but the engineering team says it would require a major redesign. What is the best course of action?

   • AConduct a feasibility study and cost-benefit analysis, then decide whether to revise the requirement to near-real-time or fund the architecture change.
   • BForce the engineering team to implement real-time detection regardless of cost.
   • CKeep the batch processing and claim it is real-time.
   • DDrop the fraud detection requirement entirely.
   Reveal Solution Discussion Select an answer first