Define Software Security Requirements CSSLP Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which of the following is an example of a non-functional security requirement?

   • AThe system shall display a warning banner before login.
   • BThe system shall encrypt all data in transit using TLS 1.2 or higher.
   • CThe system shall lock an account after five failed login attempts.
   • DThe system shall require users to change their password every 90 days.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A company is developing a new social media platform. The platform will allow users to post content and interact with others. The security team is eliciting requirements. They have identified: (A) content moderation to prevent hate speech, (B) user authentication to prevent fake accounts, (C) data encryption to protect user privacy, and (D) real-time notifications for user engagement. The company has limited resources and must prioritize. Which requirement is most critical to address first?

   • AUser authentication to prevent fake accounts
   • BContent moderation to prevent hate speech
   • CReal-time notifications for user engagement
   • DData encryption to protect user privacy
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is a key characteristic of a well-documented security requirement?

   • AIt is testable and traceable
   • BIt is written after implementation to save time
   • CIt is stored only in the developer's memory
   • DIt is written in vague terms to allow flexibility
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   When prioritizing security requirements, which factor should be considered to determine the order of implementation?

   • AThe risk and impact of the security issue the requirement addresses
   • BThe personal preference of the lead developer
   • CThe number of lines of code needed to implement the requirement
   • DThe alphabetical order of the requirement names
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   During requirements definition for a banking application, a stakeholder states: 'Users must be able to view their account balance after logging in.' Which translation best represents a functional security requirement?

   • AThe system shall be available 99.99% of the time.
   • BThe system shall require multi-factor authentication before displaying account balance.
   • CThe system shall display account balance within 3 seconds of login.
   • DThe system shall store account balance data in an encrypted database.
   Reveal Solution Discussion Select an answer first