Define Software Security Requirements CSSLP Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A development team is documenting security requirements for a new online voting system. They need to ensure that the requirements are clear and can be validated by testers. Which documentation approach is most effective?

   • AWrite requirements in a technical document using jargon.
   • BWrite requirements as a list of desired outcomes without specifics.
   • CWrite requirements only after the design is complete.
   • DWrite each requirement as a user story with acceptance criteria.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   A product owner provides the user story: 'As a customer, I want to reset my password so I can regain access to my account.' Which of the following is a functional security requirement derived from this story?

   • AThe system shall log all password reset attempts for audit purposes.
   • BThe system shall use HTTPS for all password reset communications.
   • CThe system shall store password hashes using a strong algorithm.
   • DThe system shall send a password reset link to the verified email address on file.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   During security requirements elicitation for a new e-commerce platform, which activity is most directly part of eliciting security requirements?

   • AInterviewing stakeholders to identify assets and threats
   • BDeploying the application to a staging environment
   • CWriting test cases for the final security requirements
   • DDesigning the database schema for user credentials
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A government agency is developing a public-facing permit application system. During requirements elicitation, stakeholders include citizens, agency staff, and legal counsel. The legal counsel emphasizes compliance with data protection laws, while citizens express concerns about privacy. The agency wants to ensure comprehensive security coverage. Which approach best supports comprehensive security requirements elicitation?

   • ADefer requirements elicitation until after the design phase to avoid over-constraining the architecture.
   • BReview only the legal counsel's compliance requirements to ensure regulatory adherence.
   • CUse a standard security requirements checklist from a previous project.
   • DConduct structured interviews with each stakeholder group to capture their specific security concerns and regulatory obligations.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A financial institution is developing a new online banking platform. The platform must support high transaction volumes during peak hours and maintain security. The security team is defining non-functional requirements. They are considering: (A) the system must encrypt all data in transit, (B) the system must have a maximum latency of 500ms for transactions, (C) the system must log all access attempts, and (D) the system must be able to scale horizontally during peak loads. Which two requirements are non-functional security requirements?

   • AC and D
   • BA and C
   • CA and B
   • DB and D
   Reveal Solution Discussion Select an answer first