Sequential Development Models CT-STE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A project manager is choosing between a Waterfall and an Agile approach for a new system. The system has strict regulatory requirements that must be fully documented and approved before any development begins. The security team wants to ensure that security requirements are completely defined upfront. Which characteristic of the Waterfall model makes it a good fit for this project?

   • AIt enables security testing to be performed in parallel with development
   • BIt provides a structured phase-gate process where each phase must be completed and approved before the next begins
   • CIt minimizes the cost of fixing security defects by allowing late-stage changes
   • DIt allows for continuous feedback and requirement changes throughout the project
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   In a sequential development model, when are security test plans typically created?

   • ADuring the maintenance phase
   • BDuring the implementation phase
   • CDuring the requirements phase
   • DDuring the testing phase
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   During a security design review, what is the primary focus?

   • AInstalling security patches on production servers
   • BEvaluating the architecture and design for security weaknesses
   • CWriting security test cases for the implementation phase
   • DRunning automated vulnerability scanners against the deployed system
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the main goal of threat modeling during the design phase?

   • ATo identify potential security threats and vulnerabilities in the system design
   • BTo review the code for syntax errors
   • CTo execute test cases to verify the system's functionality
   • DTo measure the performance of the system under load
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A bank is starting a V-model project for a new mobile banking app. During the requirements phase, the security team is defining what 'secure' means for this application. They need to ensure that the requirements are testable and traceable. What is the most important characteristic of the security requirements they should write?

   • AThey should be vague and high-level to allow for flexibility in design
   • BThey should focus only on functional features, not security
   • CThey should be written only after the design is complete
   • DThey should be specific, measurable, and verifiable, with clear acceptance criteria
   Reveal Solution Discussion Select an answer first