Security Requirement Engineering (SRE) CASENET Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A financial services company is defining security requirements for a new .NET trading platform. Stakeholders include the compliance team (needs audit logging), the sales team (wants minimal friction for customers), and the operations team (needs high availability). Which requirement set best balances these needs?

   • ARequire MFA for every login, disable audit logging to improve performance, and use a single server to reduce cost.
   • BSkip audit logging to protect customer privacy, allow anonymous trading, and accept downtime for maintenance.
   • CImplement comprehensive audit logging, use risk-based authentication (MFA only for high-risk transactions), and design for redundant failover.
   • DImplement logging only for failed logins, require MFA for all users, and use a load balancer without failover.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A .NET project has a security requirement that 'all input fields must be validated against a whitelist.' Midway through development, a new stakeholder requests that a rich-text editor be added, which requires allowing HTML input. What should the security lead do first?

   • AApprove the request and let the developer implement it without updating documentation.
   • BPerform an impact analysis to determine how the new feature affects the existing requirement and update the traceability matrix.
   • CAsk the stakeholder to withdraw the request to keep the project on schedule.
   • DReject the request because it violates the original requirement.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A startup is building a .NET SaaS product. They have a small budget and a short timeline. Stakeholders want: (1) SOC 2 compliance to attract enterprise customers, (2) a public API for third-party integrations, and (3) rapid feature releases. The security team proposes a set of requirements. Which approach best balances these constraints?

   • ADelay all security requirements until after the first release to meet the timeline.
   • BRequire manual security reviews for every release, which will slow down the pipeline.
   • CImplement a security requirements baseline that includes SOC 2 controls, API authentication and rate limiting, and a CI/CD pipeline with automated security scans.
   • DFocus only on SOC 2 compliance and ignore API security.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard · select all that apply

   A .NET application has the following security requirements: (1) implement role-based access control, (2) encrypt all data at rest, (3) implement audit logging, (4) achieve 99.99% availability, and (5) support single sign-on. The project has a fixed budget and a 9-month deadline. Which requirements should be prioritized for the initial release? (Select all that apply.)

   • AImplement audit logging
   • BEncrypt all data at rest
   • CImplement role-based access control
   • DSupport single sign-on
   • EAchieve 99.99% availability
   Check answers Discussion Select an answer first
6. 40application · medium

   A security analyst is writing a requirement for a .NET application's session management. Which statement is the clearest and most testable?

   • AThe application must handle sessions securely.
   • BThe application must keep users logged in until they close the browser.
   • CThe application must expire inactive sessions after 15 minutes and invalidate the session token server-side upon logout.
   • DThe application should use a reasonable session timeout.
   Reveal Solution Discussion Select an answer first