CSSLP Secure Software Requirements — 20 Questions

Question 1

You are eliciting security requirements for an application that must comply with PCI-DSS. What is the most effective way to identify the scope of the systems requiring the highest level of security?

Accepted Answer

Map the data flow of credit card information. PCI-DSS requires identifying the Cardholder Data Environment (CDE) to define the scope of compliance, which is the most critical first step.

Answer

Perform a network vulnerability scan

Answer

Review the application source code

Answer

Update the firewall rule set

Question 2

A stakeholder requests a feature that allows users to bypass password complexity requirements for 'internal testing accounts.' As a CSSLP, what is your first step in requirements analysis?

Accepted Answer

Document the risk and perform a formal risk assessment. Analyzing the risk versus the business need is the standard procedure when a requirement violates security policy.

Answer

Immediately reject the request

Answer

Update the password policy

Answer

Implement the bypass in dev only

Question 3

When gathering requirements for a new healthcare application, which regulation must be consulted to ensure the proper handling of Protected Health Information (PHI)?

Accepted Answer

HIPAA. HIPAA (Health Insurance Portability and Accountability Act) is the primary regulation for securing PHI in the United States.

Answer

GDPR

Answer

FISMA

Answer

SOX

Question 4

An application requires multi-factor authentication (MFA) for administrative access. During requirements gathering, the security team determines that SMS-based MFA is insufficient for high-risk accounts. What documentation artifact should reflect this specific requirement?

Accepted Answer

Security Requirements Traceability Matrix (SRTM). A security constraint or non-functional requirement document defines specific technical standards that the solution must meet.

Answer

Threat Intelligence Feed

Answer

Change Request Log

Answer

Project Charter

Question 5

You are managing requirements for a distributed microservices application. You need to ensure that service-to-service communication is encrypted. Which requirement type best categorizes this constraint?

Accepted Answer

Non-functional security requirement. Security requirements are often classified as non-functional requirements because they define how the system performs or behaves rather than what specific business function it provides.

Answer

Functional requirement

Answer

Business rule

Answer

Use case description

Question 6

During a project migration to GDPR compliance, the development team must ensure that personal data is deleted upon user request. Where should these specific data lifecycle constraints be documented to ensure they influence the architectural design?

Accepted Answer

The Software Requirements Specification (SRS). Security requirements must be integrated into the Software Requirements Specification (SRS) or the project's requirements management tool (like Jira or Azure DevOps) to ensure they are tracked as functional constraints.

Answer

The Penetration Testing Report

Answer

The Infrastructure-as-Code (IaC) templates

Answer

The Risk Register

Question 7

You are reviewing the requirements for a legacy system integration. The system currently transmits credentials over plaintext protocols. What is the priority for the security requirements phase?

Accepted Answer

Mandate the migration to an encrypted transport layer in the SRS. The primary objective of security requirements is to eliminate known vulnerabilities at the design stage, which means mandating modern protocols (like TLS 1.3) as a requirement.

Answer

Request a waiver for the legacy system

Answer

Suggest the use of a VPN for the entire network

Answer

Document the legacy protocol as a technical debt item

Question 8

You are leading a threat modeling session for a new cloud-native application. You identify a potential threat where an attacker attempts to inject malicious SQL queries into the search bar. Which technique should you employ to document this behavior during the Secure Software Requirements phase?

Accepted Answer

Misuse Case Modeling. Abuse cases are specifically designed to describe how an attacker might interact with the system to achieve a malicious objective, making them the correct tool for documenting such threats during requirements gathering.

Answer

Attack Tree Analysis

Answer

Data Flow Diagramming

Answer

Compliance Matrix Mapping

Question 9

Which of the following describes the purpose of 'misuse case' modeling?

Accepted Answer

To describe scenarios where the system is used to cause harm. Misuse cases identify threats by describing how an actor can misuse the system to create a negative impact.

Answer

To ensure user interface guidelines are followed

Answer

To identify all potential bugs in the code

Answer

To document the project timeline

Question 10

A government client requires that all software be validated against FIPS 140-3 standards. During requirements gathering, what is the most important step for the cryptographic module implementation?

Accepted Answer

Ensure all cryptographic modules are FIPS-validated. FIPS 140-3 validates the specific cryptographic modules used; therefore, the requirement must mandate the use of pre-validated modules.

Answer

Implement multi-party authorization

Answer

Develop custom encryption algorithms

Answer

Encrypt all databases at rest

Question 11

Which document is essential to map regulatory compliance requirements to specific software features?

Accepted Answer

Security Requirements Traceability Matrix (SRTM). A Traceability Matrix is the standard tool for showing the relationship between regulatory requirements and technical implementation.

Answer

System Architecture Document

Answer

Incident Response Plan

Answer

Software Development Plan

Question 12

You are analyzing an application to prevent unauthorized API access. Which requirement elicitation technique is best suited to identify potential entry points that an attacker might exploit?

Accepted Answer

Abuse Case Modeling. Abuse case analysis is specifically focused on identifying entry points and malicious usage paths during the requirements phase.

Answer

User Story Mapping

Answer

Compliance Gap Analysis

Answer

Cost-Benefit Analysis

Question 13

When gathering security requirements, what is the primary challenge when dealing with 'shadow IT' within a large enterprise?

Accepted Answer

Lack of visibility and consistent security enforcement. Shadow IT systems operate outside of managed security requirements, making it difficult to ensure they meet corporate compliance or security standards.

Answer

Slow deployment speeds

Answer

High infrastructure costs

Answer

Excessive user training

Question 14

Which phase of the secure software lifecycle is the most cost-effective for identifying and correcting security requirements?

Accepted Answer

Requirements phase. The earlier a requirement gap is identified, the cheaper it is to fix (before design or coding begins).

Answer

Maintenance phase

Answer

Deployment phase

Answer

Testing phase

Question 15

You are determining compliance requirements for a software product that handles PII. Which requirement is essential for demonstrating 'Privacy by Design'?

Accepted Answer

Enforce data minimization throughout the lifecycle. Data minimization is a core principle of Privacy by Design, ensuring only necessary data is collected.

Answer

Use the largest possible key size

Answer

Implement full data retention

Answer

Outsource all PII processing

Question 16

In the context of 'Secure Software Requirements', what should the security team do when they encounter a conflict between usability and security?

Accepted Answer

Conduct a risk-based assessment to find a balanced approach. Security requirements must be balanced with usability; the team should seek a solution that satisfies both if possible, or perform a risk assessment.

Answer

Ignore the usability concern

Answer

Always prioritize security over usability

Answer

Ask the developers to make the final decision

Question 17

Which TWO inputs are most important when developing 'Abuse Cases'?

Accepted Answer

System functional requirements. Abuse cases require understanding the system's intended functions and the threat landscape, usually through threat models.

Answer

The annual maintenance budget

Answer

Developer performance metrics

Answer

The internal office floor plan

Question 18

When designing a system that must satisfy both HIPAA and local privacy laws, which requirement approach is most appropriate?

Accepted Answer

Adopt the most restrictive controls from all applicable regulations. When multiple regulations apply, the software must satisfy the most restrictive requirements of each to ensure full compliance.

Answer

Prioritize HIPAA over local laws

Answer

Follow only the most recent regulation

Answer

Create separate modules for each regulation

Question 19

Which THREE categories are typically used to classify security requirements?

Accepted Answer

Confidentiality. Security requirements are generally grouped by confidentiality, integrity, and availability (the CIA triad).

Answer

Project Profitability

Answer

Marketing Appeal

Question 20

What is the primary goal of performing a 'Security Gap Analysis' during the requirements phase?

Accepted Answer

To identify missing security controls against a baseline or standard. A gap analysis compares the existing state or desired requirements against security standards to identify missing controls.

Answer

To find bugs in the application code

Answer

To calculate the ROI of security spending

Answer

To document the project budget