Define Software Security Requirements CSSLP Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A development team is documenting security requirements for a new online payment gateway. They need to ensure that the requirements are traceable and testable. Which documentation practice is most effective?

   • ADocument requirements only in the code comments.
   • BWrite requirements in a single paragraph to save time.
   • CUse vague terms like 'secure' and 'robust' to allow flexibility.
   • DCreate a requirements traceability matrix linking each requirement to its source and test cases.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   A healthcare application must ensure that patient data remains accessible even during a regional network outage. Which type of non-functional security requirement addresses this need?

   • AIntegrity requirement
   • BConfidentiality requirement
   • CAvailability requirement
   • DAuthentication requirement
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A retail company is developing a loyalty program app that collects customer purchase history. During requirements elicitation, the marketing team wants to use the data for targeted promotions, while the legal team warns about privacy regulations. The security team needs to define requirements that address both business and compliance needs. Which elicitation technique is most effective in this situation?

   • AFacilitate a joint workshop with marketing, legal, and security to align on data usage and privacy constraints.
   • BReview competitor apps to infer security requirements.
   • CUse a survey to collect requirements from customers.
   • DAsk only the legal team to provide compliance requirements.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A multinational corporation is developing an internal HR system that will be accessed by employees in multiple countries. The system will store personal data, including salary information. The company must comply with GDPR for European employees and local data protection laws in other regions. The security team is defining non-functional security requirements. Which requirement set best addresses these compliance and operational needs?

   • AThe system shall allow employees to access data from any location without restrictions.
   • BThe system shall enforce data residency by storing employee data in the region where the employee is located.
   • CThe system shall encrypt all data at rest and in transit.
   • DThe system shall use a single global data center to simplify management.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which documentation attribute is essential for tracing a security requirement back to its origin?

   • AA detailed description of the implementation code
   • BThe name of the developer who will implement it
   • CA unique identifier and a reference to the source (e.g., regulation, stakeholder)
   • DThe estimated cost of implementation
   Reveal Solution Discussion Select an answer first