Security Requirement Engineering (SRE) CASENET Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   In the context of the software development lifecycle, what is the primary purpose of security requirement engineering?

   • ATo define and document security needs early so they can be designed, implemented, and verified systematically
   • BTo write user manuals and training materials for secure coding practices
   • CTo select and configure the organization's firewall and intrusion detection systems
   • DTo perform penetration testing after the application is fully developed
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Why is traceability important in security requirements management?

   • AIt speeds up the compilation process
   • BIt automatically fixes security vulnerabilities
   • CIt eliminates the need for security testing
   • DIt ensures that each requirement can be linked to design, code, and tests
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which technique is commonly used for security requirements validation?

   • ARequirements walkthrough with stakeholders
   • BCode compilation
   • CDatabase normalization
   • DAutomated penetration testing
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A healthcare startup is building a .NET web application that will store patient records. During the requirements elicitation phase, the product owner states that the app must be 'secure' but provides no specifics. The compliance officer reminds the team that HIPAA applies. Which action best captures a testable security requirement from this input?

   • AAsk the product owner to define 'secure' in a future sprint and proceed with development.
   • BRecord: 'The application must be secure and comply with all applicable laws.'
   • CDocument: 'The application must encrypt all patient data at rest and in transit using AES-256 and TLS 1.2 or higher.'
   • DImplement encryption as a default setting without documenting it as a requirement.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   During a security requirements validation workshop, the team discovers that a requirement is technically infeasible with the current architecture. The requirement is to encrypt all data in a legacy database that does not support encryption. What is the best course of action?

   • AModify the requirement to use application-level encryption before storing data.
   • BDefer the requirement to a future project phase.
   • CKeep the requirement and force the database to support encryption.
   • DRemove the requirement because it is infeasible.
   Reveal Solution Discussion Select an answer first