Model (non-Functional) Security Properties and Constraints CSSLP Practice Questions (Page 6)

Questions 26–27

1. 26application · medium

   A healthcare startup is designing a patient portal that allows users to view lab results. The product owner insists that patients must be able to access results with a single tap from their mobile device, with no additional login prompts. The security architect warns that lab results are sensitive and must be protected. Which design decision best balances usability and security?

   • ADisable session timeouts entirely to ensure patients never face a login prompt.
   • BStore lab results on the device so they are available offline without any authentication.
   • CRequire multi-factor authentication for every single view of a lab result.
   • DImplement a session timeout of 15 minutes and require re-authentication for viewing lab results after the timeout.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which approach is most appropriate when security and usability requirements conflict during architecture design?

   • AIgnore usability concerns and focus solely on security
   • BAlways prioritize usability over security
   • CAlways prioritize security over usability
   • DEvaluate the risks and benefits of each option and make a balanced decision
   Reveal Solution Discussion Select an answer first