Requirements and Design CT-SEC Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A team is gathering requirements for a new online payment system. The product manager lists functional requirements such as 'user can pay via credit card' and 'user can view transaction history.' As the security tester, you are asked to contribute to the requirements. Which activity is most appropriate at this stage?

   • ADraft a security test plan that focuses only on penetration testing after implementation.
   • BWait until the design is complete to run a vulnerability scan on the payment module.
   • CAsk the product manager to remove the transaction history feature to reduce attack surface.
   • DPerform a threat modeling exercise on the listed requirements to identify threats like card data interception and unauthorized transaction viewing.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A design for a new healthcare system includes a patient portal, a backend database, and an integration with a third-party lab system. The security tester is asked to validate the design. Which action best validates that the architecture supports security requirements?

   • ACheck that the design includes a secure API gateway for the third-party integration with proper authentication and rate limiting.
   • BVerify that all developers have access to the production database for debugging.
   • CEnsure that the database is hosted on-premises to avoid cloud security risks.
   • DConfirm that the patient portal uses the latest web framework.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary purpose of integrating security testing considerations into the requirements phase of the software lifecycle?

   • ATo finalize the test environment and tools before development begins.
   • BTo replace the need for security testing in later phases.
   • CTo identify security requirements and potential threats early, when they are less costly to address.
   • DTo ensure that all security defects are fixed before coding starts.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which technique is commonly used to systematically identify threats during threat modeling?

   • APESTLE analysis
   • BSTRIDE
   • CRoot cause analysis
   • DSWOT analysis
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   In security architecture analysis, what is a trust boundary?

   • AThe physical perimeter of the data center.
   • BA firewall that blocks all incoming traffic.
   • CA point where the level of trust changes, such as between an external user and the internal system.
   • DA point where data is encrypted.
   Reveal Solution Discussion Select an answer first