A .NET project has a security requirement that 'all database queries must use parameterized statements.' A developer proposes using an ORM that generates dynamic SQL for complex reports. What should the security lead do?

Evaluate the ORM's SQL generation for injection risks, and if safe, update the requirement to allow ORM-generated queries that are reviewed for parameterization.

Change the requirement to 'use any database access method.'

Reject the ORM proposal because it violates the requirement.

Allow the ORM without any review to speed up development.

What is the main goal of security requirements analysis?

To prioritize and refine security requirements based on risk and business impact

To immediately implement all identified security controls

To delete any requirement that is difficult to test

To assign a unique identifier to each requirement

EC-CouncilCertified Application Security Engineer (.NET)

Domain 2Objective 1

Security Requirement Engineering (SRE) CASENET Practice Questions (Page 9)

Part of the Security Requirements and Secure Design domain, which makes up ~21% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–17 in this domain), expect 2–2 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

6concepts

Questions 41–42

41application · medium
A .NET project has a security requirement that 'all database queries must use parameterized statements.' A developer proposes using an ORM that generates dynamic SQL for complex reports. What should the security lead do?
Select an answer first
42foundation · easy
What is the main goal of security requirements analysis?
Select an answer first

Finished these 2 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CASENET

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASENET” is a trademark of its owner, used for identification only.

Security Requirement Engineering (SRE) CASENET Practice Questions (Page 9)

Questions 41–42

A .NET project has a security requirement that 'all database queries must use parameterized statements.' A developer proposes using an ORM that generates dynamic SQL for complex reports. What should the security lead do?

What is the main goal of security requirements analysis?

Keep studying — Security Requirements and Secure Design