Secure Software Requirements

You are eliciting security requirements for an application that must comply with PCI-DSS. What is the most effective way to identify the scope of the systems requiring the highest level of security?

A stakeholder requests a feature that allows users to bypass password complexity requirements for 'internal testing accounts.' As a CSSLP, what is your first step in requirements analysis?

When gathering requirements for a new healthcare application, which regulation must be consulted to ensure the proper handling of Protected Health Information (PHI)?

An application requires multi-factor authentication (MFA) for administrative access. During requirements gathering, the security team determines that SMS-based MFA is insufficient for high-risk accounts. What documentation artifact should reflect this specific requirement?

You are managing requirements for a distributed microservices application. You need to ensure that service-to-service communication is encrypted. Which requirement type best categorizes this constraint?

During a project migration to GDPR compliance, the development team must ensure that personal data is deleted upon user request. Where should these specific data lifecycle constraints be documented to ensure they influence the architectural design?

You are reviewing the requirements for a legacy system integration. The system currently transmits credentials over plaintext protocols. What is the priority for the security requirements phase?

You are leading a threat modeling session for a new cloud-native application. You identify a potential threat where an attacker attempts to inject malicious SQL queries into the search bar. Which technique should you employ to document this behavior during the Secure Software Requirements phase?

Which of the following describes the purpose of 'misuse case' modeling?

A government client requires that all software be validated against FIPS 140-3 standards. During requirements gathering, what is the most important step for the cryptographic module implementation?

Which document is essential to map regulatory compliance requirements to specific software features?

You are analyzing an application to prevent unauthorized API access. Which requirement elicitation technique is best suited to identify potential entry points that an attacker might exploit?

When gathering security requirements, what is the primary challenge when dealing with 'shadow IT' within a large enterprise?

Which phase of the secure software lifecycle is the most cost-effective for identifying and correcting security requirements?

You are determining compliance requirements for a software product that handles PII. Which requirement is essential for demonstrating 'Privacy by Design'?

In the context of 'Secure Software Requirements', what should the security team do when they encounter a conflict between usability and security?

Which TWO inputs are most important when developing 'Abuse Cases'?

When designing a system that must satisfy both HIPAA and local privacy laws, which requirement approach is most appropriate?

Which THREE categories are typically used to classify security requirements?

What is the primary goal of performing a 'Security Gap Analysis' during the requirements phase?

Which TWO of the following are primary benefits of including security requirements early in the SDLC?

Which THREE items should be included in a 'Security Requirements Traceability Matrix'?

Which THREE factors must be considered when defining 'Compliance Requirements' for an international software product?

Which TWO methods are effective for eliciting security requirements from non-technical business stakeholders?

Which TWO factors are critical when identifying compliance requirements for software that processes cross-border financial transactions?

When updating requirements for a legacy system to improve its security posture, which THREE actions should the CSSLP prioritize?

You are a security architect for a FinTech startup building a mobile payment app. The product owner has provided a list of functional user stories but no security requirements. You need to integrate security into the Agile development process without disrupting the sprint cadence. Which approach BEST ensures security requirements are identified and documented continuously?

You are eliciting security requirements for a new online banking application. The business stakeholders are focused on features and have limited security knowledge. You need to ensure that security requirements are complete, unambiguous, and testable. Which technique is MOST appropriate to achieve this?

You are a security analyst tasked with reviewing a set of security requirements for a new web application. One requirement states: 'The application must be secure.' What is the PRIMARY issue with this requirement?

You are leading a requirements elicitation session for a new EHR system. A stakeholder from the legal department insists that the system must comply with HIPAA. Another stakeholder from the clinical team wants quick access to patient records for emergency situations. You need to document a security requirement that balances these needs. Which requirement BEST addresses both compliance and usability?

A healthcare software development team is building a patient portal that must comply with HIPAA. The team has completed a risk assessment and identified several potential threats. They now need to translate these findings into actionable security requirements. Which of the following is the MOST effective approach to ensure that the security requirements adequately address the identified risks?

A software development team is creating a new e-commerce application. During requirements elicitation, the security architect suggests using misuse cases to identify security requirements. Which of the following BEST describes the primary purpose of misuse cases in this context?

A software company is developing a cloud-based collaboration platform that will be used by government agencies. The platform must adhere to FedRAMP requirements. The security team is defining security requirements and needs to ensure that data in transit is protected. Which of the following requirements is MOST appropriate to include in the security requirements specification to meet FedRAMP requirements?