Requirements and Design CT-SEC Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A product owner wants to add a feature that allows users to export their personal data in a machine-readable format. The security tester must ensure that security requirements are considered. Which requirement is most important to add?

   • ARequire that the export feature be implemented using a third-party library.
   • BRequire that the export format be JSON for ease of use.
   • CRequire authentication and authorization before allowing data export, and log all export activities.
   • DRequire that the export feature be available only on the mobile app.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   After assessing security risks in requirements, what is the primary purpose of prioritizing them?

   • ATo allocate resources to mitigate the most critical risks first.
   • BTo document risks for compliance purposes only.
   • CTo eliminate all risks from the project.
   • DTo assign blame for security issues.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company is developing a new customer support system. During requirements gathering, the team identifies several security requirements: encryption of customer data, role-based access control, and a public API for partners. The security tester must prioritize these requirements. Which requirement should be given the highest priority based on risk?

   • ARole-based access control, because it is a common security feature.
   • BPublic API for partners, because it increases business reach.
   • CEncryption of customer data, because a data breach would have high impact and likelihood.
   • DAll requirements are equally important and should be prioritized equally.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A design review is scheduled for a new customer relationship management (CRM) system. The security tester is part of the review team. Which activity is most aligned with a security-focused design review?

   • AExamine the design documents to identify potential design flaws such as missing input validation on external interfaces.
   • BEnsure that the design includes a firewall to protect the network.
   • CRun a penetration test on the production CRM system to find vulnerabilities.
   • DReview the code for SQL injection vulnerabilities.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What does 'attack surface' refer to in security architecture analysis?

   • AThe list of known vulnerabilities in the system.
   • BThe total set of points where an attacker can try to enter or extract data from the system.
   • CThe graphical representation of the network topology.
   • DThe number of users who have access to the system.
   Reveal Solution Discussion Select an answer first