CSSLP Secure Software Requirements — 20 Questions

Question 1

You are defining security requirements for a new IoT device that will collect and transmit sensor data to a cloud backend. You need to ensure that the requirements address data protection in transit and at rest. (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The cloud backend must store all received data in an encrypted database using transparent data encryption (TDE).. The two requirements that directly address data protection are encrypting sensor data before transmission (protecting data in transit) and encrypting stored data in the cloud database (protecting data at rest). Together, they ensure confidentiality throughout the data lifecycle. The other options focus on device integrity, access control, or authentication, which are important but do not specifically protect the data itself from unauthorized disclosure.

Answer

The device must use a unique, per-device certificate for mutual authentication with the cloud.

Answer

The cloud backend must enforce role-based access control (RBAC) for all users accessing the sensor data.

Answer

The device must implement a secure boot process to verify firmware integrity before operation.

Question 2

A financial services company is developing a mobile banking application that must comply with PCI DSS. The security team is defining security requirements and needs to ensure that authentication mechanisms meet regulatory and business needs. Which TWO of the following requirements are MOST appropriate to include in the security requirements specification? (Choose two.)

Accepted Answer

The application must enforce multi-factor authentication for all users accessing sensitive account information.. The two most appropriate requirements are enforcing multi-factor authentication for sensitive access and securely storing authentication credentials. These directly address PCI DSS requirements for access control and data protection. Other options either weaken security, are insufficient alone, or focus on detective rather than preventive controls.

Answer

The application must log all authentication attempts and store logs for at least 30 days.

Answer

The application must implement a password complexity policy that requires at least 8 characters with a mix of letters and numbers.

Answer

The application must allow users to authenticate using only a username and password to simplify the user experience.

Question 3

You are eliciting security requirements for an application that must comply with PCI-DSS. What is the most effective way to identify the scope of the systems requiring the highest level of security?

Accepted Answer

Map the data flow of credit card information. PCI-DSS requires identifying the Cardholder Data Environment (CDE) to define the scope of compliance, which is the most critical first step.

Answer

Perform a network vulnerability scan

Answer

Review the application source code

Answer

Update the firewall rule set

Question 4

A stakeholder requests a feature that allows users to bypass password complexity requirements for 'internal testing accounts.' As a CSSLP, what is your first step in requirements analysis?

Accepted Answer

Document the risk and perform a formal risk assessment. A CSSLP's role in requirements analysis is to surface and quantify security risk, not to unilaterally veto business requests. Documenting the risk and performing a formal risk assessment gives stakeholders the information needed to make an informed accept/mitigate/reject decision, preserving the requirements-engineering process. This aligns with CSSLP's emphasis on integrating risk management into the SDLC rather than acting as a gatekeeper.

Answer

Immediately reject the request

Answer

Update the password policy

Answer

Implement the bypass in dev only

Question 5

When gathering requirements for a new healthcare application, which regulation must be consulted to ensure the proper handling of Protected Health Information (PHI)?

Accepted Answer

HIPAA. HIPAA (Health Insurance Portability and Accountability Act) is the U.S. federal law governing the privacy and security of Protected Health Information (PHI), including the Privacy Rule, Security Rule, and Breach Notification Rule. Any application handling PHI for a covered entity or business associate must comply with HIPAA's administrative, physical, and technical safeguards.

Answer

GDPR

Answer

FISMA

Answer

SOX

Question 6

An application requires multi-factor authentication (MFA) for administrative access. During requirements gathering, the security team determines that SMS-based MFA is insufficient for high-risk accounts. What documentation artifact should reflect this specific requirement?

Accepted Answer

Security Requirements Traceability Matrix (SRTM). The Security Requirements Traceability Matrix (SRTM) is the documentation artifact that maps each security requirement to its source, design, implementation, and test evidence. Since the security team has determined that SMS-based MFA is insufficient for high-risk administrative accounts, this specific requirement must be captured and traced through the SDLC. The SRTM ensures the requirement is not lost and can be verified during testing and audit.

Answer

Threat Intelligence Feed

Answer

Change Request Log

Answer

Project Charter

Question 7

You are managing requirements for a distributed microservices application. You need to ensure that service-to-service communication is encrypted. Which requirement type best categorizes this constraint?

Accepted Answer

Non-functional security requirement. Encryption of service-to-service traffic is a quality attribute describing how the system behaves, not a specific function it performs, so it is a non-functional security requirement. It constrains the architecture (e.g., mTLS, TLS 1.3) rather than describing a user-visible behavior. CSSLP categorizes such constraints as non-functional requirements that shape design and verification.

Answer

Functional requirement

Answer

Business rule

Answer

Use case description

Question 8

During a project migration to GDPR compliance, the development team must ensure that personal data is deleted upon user request. Where should these specific data lifecycle constraints be documented to ensure they influence the architectural design?

Accepted Answer

The Software Requirements Specification (SRS). Security requirements must be integrated into the Software Requirements Specification (SRS) or the project's requirements management tool (like Jira or Azure DevOps) to ensure they are tracked as functional constraints.

Answer

The Penetration Testing Report

Answer

The Infrastructure-as-Code (IaC) templates

Answer

The Risk Register

Question 9

You are reviewing the requirements for a legacy system integration. The system currently transmits credentials over plaintext protocols. What is the priority for the security requirements phase?

Accepted Answer

Mandate the migration to an encrypted transport layer in the SRS. The security requirements phase is where security controls are formally specified in the Software Requirements Specification (SRS). Since the legacy system transmits credentials in plaintext, the priority is to mandate a secure replacement—encrypted transport (e.g., TLS/SSL, SSH, or IPsec)—as a requirement in the SRS. This ensures the security need is captured, tracked, and implemented, rather than deferred or mitigated only at the network level. Documenting technical debt or requesting a waiver does not fix the vulnerability; it merely acknowledges it.

Answer

Request a waiver for the legacy system

Answer

Suggest the use of a VPN for the entire network

Answer

Document the legacy protocol as a technical debt item

Question 10

You are leading a threat modeling session for a new cloud-native application. You identify a potential threat where an attacker attempts to inject malicious SQL queries into the search bar. Which technique should you employ to document this behavior during the Secure Software Requirements phase?

Accepted Answer

Misuse Case Modeling. Misuse case modeling documents how a system can be misused by an actor (the misuser) to achieve a malicious goal, which is exactly what is needed to capture an attacker injecting SQL into a search bar during the Secure Software Requirements phase. It complements use cases by describing negative behavior and is used to derive security requirements and test cases. Attack trees are better suited to decomposing a high-level attack goal into sub-goals during threat modeling, not for documenting a specific misuse scenario in requirements.

Answer

Attack Tree Analysis

Answer

Data Flow Diagramming

Answer

Compliance Matrix Mapping

Question 11

Which of the following describes the purpose of 'misuse case' modeling?

Accepted Answer

To describe scenarios where the system is used to cause harm. Misuse cases identify threats by describing how an actor can misuse the system to create a negative impact.

Answer

To ensure user interface guidelines are followed

Answer

To identify all potential bugs in the code

Answer

To document the project timeline

Question 12

A government client requires that all software be validated against FIPS 140-3 standards. During requirements gathering, what is the most important step for the cryptographic module implementation?

Accepted Answer

Ensure all cryptographic modules are FIPS-validated. FIPS 140-3 validates the specific cryptographic modules used; therefore, the requirement must mandate the use of pre-validated modules.

Answer

Implement multi-party authorization

Answer

Develop custom encryption algorithms

Answer

Encrypt all databases at rest

Question 13

Which document is essential to map regulatory compliance requirements to specific software features?

Accepted Answer

Security Requirements Traceability Matrix (SRTM). A Security Requirements Traceability Matrix (SRTM) maps security and regulatory requirements to specific software features, controls, and test cases, providing bidirectional traceability from requirement to implementation and verification. It is the essential document for demonstrating that each regulatory obligation is addressed by a concrete feature or control. This traceability is critical for audits (e.g., PCI DSS, HIPAA, SOX) and for change management.

Answer

System Architecture Document

Answer

Incident Response Plan

Answer

Software Development Plan

Question 14

You are analyzing an application to prevent unauthorized API access. Which requirement elicitation technique is best suited to identify potential entry points that an attacker might exploit?

Accepted Answer

Abuse Case Modeling. Abuse case modeling deliberately thinks like an attacker, enumerating misuse scenarios and entry points that legitimate use cases overlook. It is specifically designed to surface attack surfaces such as unauthenticated endpoints, parameter tampering, and privilege escalation paths. This makes it the best elicitation technique for identifying exploitable API entry points.

Answer

User Story Mapping

Answer

Compliance Gap Analysis

Answer

Cost-Benefit Analysis

Question 15

When gathering security requirements, what is the primary challenge when dealing with 'shadow IT' within a large enterprise?

Accepted Answer

Lack of visibility and consistent security enforcement. Shadow IT systems operate outside of managed security requirements, making it difficult to ensure they meet corporate compliance or security standards.

Answer

Slow deployment speeds

Answer

High infrastructure costs

Answer

Excessive user training

Question 16

Which phase of the secure software lifecycle is the most cost-effective for identifying and correcting security requirements?

Accepted Answer

Requirements phase. The earlier a requirement gap is identified, the cheaper it is to fix (before design or coding begins).

Answer

Maintenance phase

Answer

Deployment phase

Answer

Testing phase

Question 17

You are determining compliance requirements for a software product that handles PII. Which requirement is essential for demonstrating 'Privacy by Design'?

Accepted Answer

Enforce data minimization throughout the lifecycle. Privacy by Design, as articulated by Ann Cavoukian and embedded in GDPR Article 25 and NIST Privacy Framework, requires that personal data be minimized — collected only when necessary, used only for stated purposes, and retained only as long as needed. Enforcing data minimization throughout the lifecycle directly implements the 'data minimization' and 'purpose limitation' principles, reducing privacy risk by limiting the attack surface and exposure of PII.

Answer

Use the largest possible key size

Answer

Implement full data retention

Answer

Outsource all PII processing

Question 18

In the context of 'Secure Software Requirements', what should the security team do when they encounter a conflict between usability and security?

Accepted Answer

Conduct a risk-based assessment to find a balanced approach. When usability and security conflict, the correct approach is a risk-based assessment that weighs the likelihood and impact of the threat against the usability cost of the control, then selects a balanced mitigation. Security is not absolute — controls that destroy usability drive users to work around them (shadow IT, password reuse), which often increases overall risk. A documented risk-based decision also provides defensible rationale for auditors and stakeholders.

Answer

Ignore the usability concern

Answer

Always prioritize security over usability

Answer

Ask the developers to make the final decision

Question 19

Which TWO inputs are most important when developing 'Abuse Cases'?

Accepted Answer

System functional requirements. Option A (System functional requirements) is correct because abuse cases are derived by systematically negating and misusing each legitimate function the system is specified to perform, so the functional requirements define the attack surface and the intended behaviors that must be subverted. Option D (Known threat intelligence and past incident history) is correct because real-world attacker tactics, techniques, and procedures (TTPs) and prior incidents reveal which abuses are realistic and likely, grounding the abuse cases in evidence rather than speculation. The annual maintenance budget (B) is a financial planning input that does not describe attacker behavior or system functionality, so it cannot drive abuse-case content. Developer performance metrics (C) measure productivity or code quality and are irrelevant to modeling adversarial misuse. The internal office floor plan (E) is a physical-security artifact and, while tangentially related to facility security, is not a primary input for developing abuse cases about system behavior.

Answer

The annual maintenance budget

Answer

Developer performance metrics

Answer

The internal office floor plan

Question 20

When designing a system that must satisfy both HIPAA and local privacy laws, which requirement approach is most appropriate?

Accepted Answer

Adopt the most restrictive controls from all applicable regulations. When multiple regulations apply simultaneously, the correct engineering approach is to adopt the most restrictive controls from each applicable regulation, because a control that satisfies the strictest requirement generally satisfies the looser ones as well. This avoids building parallel compliance silos and produces a single unified control set that is defensible to every auditor. HIPAA sets a floor, not a ceiling, and local privacy laws (e.g., GDPR, state statutes) may impose stricter breach notification, consent, or data-residency rules that must also be met.

Answer

Prioritize HIPAA over local laws

Answer

Follow only the most recent regulation

Answer

Create separate modules for each regulation