Security Requirement Engineering (SRE) CASENET Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A .NET application has a large set of security requirements, but the project has limited time and budget. The risk assessment shows that the most critical risk is data breach, followed by service disruption, and then reputational damage. Which prioritization strategy best aligns with the risk assessment?

   • APrioritize requirements that are mandated by the project sponsor, even if they are low risk.
   • BPrioritize requirements that address data breach, then service disruption, then reputational damage.
   • CPrioritize requirements that are easiest to implement, regardless of risk.
   • DPrioritize requirements that are most visible to customers, such as privacy notices.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A .NET application has the following security requirements: (1) encrypt all data at rest, (2) implement multi-factor authentication for administrators, (3) log all access to sensitive data, and (4) ensure the application is available 99.99% of the time. The project has limited resources. Which requirement is most likely to be considered a 'non-functional' security requirement that may be deprioritized?

   • AImplement multi-factor authentication for administrators
   • BEnsure the application is available 99.99% of the time
   • CEncrypt all data at rest
   • DLog all access to sensitive data
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A security analyst writes the following requirement for a .NET API: 'The system must handle authentication securely.' During validation, the tester asks for clarification. Which revised requirement is the most testable and unambiguous?

   • AThe API must not allow unauthorized access.
   • BThe API must authenticate users before allowing access to resources.
   • CThe API must reject requests with missing or malformed authentication tokens with HTTP 401.
   • DThe API must use best-practice authentication mechanisms.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A security architect is writing requirements for a .NET microservices architecture. The team needs to ensure that services authenticate each other. Which requirement is the most testable and secure?

   • AEach service must present a valid JWT signed by the internal identity provider, and the receiving service must validate the signature and expiration on every request.
   • BServices should use API keys for authentication.
   • CServices must authenticate using a shared secret.
   • DServices must trust each other because they are on the same network.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   What is the primary goal of security requirements management?

   • ATo eliminate all security requirements to reduce costs
   • BTo control changes to requirements and maintain traceability
   • CTo write the final security test report
   • DTo design the system architecture
   Reveal Solution Discussion Select an answer first