CSSLP Secure Software Requirements Practice Test 2 — 15 Questions

Question 1

Which phase of the secure software lifecycle is the most cost-effective for identifying and correcting security requirements?

Accepted Answer

Requirements phase. The earlier a requirement gap is identified, the cheaper it is to fix (before design or coding begins).

Answer

Maintenance phase

Answer

Deployment phase

Answer

Testing phase

Question 2

You are determining compliance requirements for a software product that handles PII. Which requirement is essential for demonstrating 'Privacy by Design'?

Accepted Answer

Enforce data minimization throughout the lifecycle. Privacy by Design, as articulated by Ann Cavoukian and embedded in GDPR Article 25 and NIST Privacy Framework, requires that personal data be minimized — collected only when necessary, used only for stated purposes, and retained only as long as needed. Enforcing data minimization throughout the lifecycle directly implements the 'data minimization' and 'purpose limitation' principles, reducing privacy risk by limiting the attack surface and exposure of PII.

Answer

Use the largest possible key size

Answer

Implement full data retention

Answer

Outsource all PII processing

Question 3

In the context of 'Secure Software Requirements', what should the security team do when they encounter a conflict between usability and security?

Accepted Answer

Conduct a risk-based assessment to find a balanced approach. When usability and security conflict, the correct approach is a risk-based assessment that weighs the likelihood and impact of the threat against the usability cost of the control, then selects a balanced mitigation. Security is not absolute — controls that destroy usability drive users to work around them (shadow IT, password reuse), which often increases overall risk. A documented risk-based decision also provides defensible rationale for auditors and stakeholders.

Answer

Ignore the usability concern

Answer

Always prioritize security over usability

Answer

Ask the developers to make the final decision

Question 4

Which TWO inputs are most important when developing 'Abuse Cases'?

Accepted Answer

System functional requirements. Option A (System functional requirements) is correct because abuse cases are derived by systematically negating and misusing each legitimate function the system is specified to perform, so the functional requirements define the attack surface and the intended behaviors that must be subverted. Option D (Known threat intelligence and past incident history) is correct because real-world attacker tactics, techniques, and procedures (TTPs) and prior incidents reveal which abuses are realistic and likely, grounding the abuse cases in evidence rather than speculation. The annual maintenance budget (B) is a financial planning input that does not describe attacker behavior or system functionality, so it cannot drive abuse-case content. Developer performance metrics (C) measure productivity or code quality and are irrelevant to modeling adversarial misuse. The internal office floor plan (E) is a physical-security artifact and, while tangentially related to facility security, is not a primary input for developing abuse cases about system behavior.

Answer

The annual maintenance budget

Answer

Developer performance metrics

Answer

The internal office floor plan

Question 5

When designing a system that must satisfy both HIPAA and local privacy laws, which requirement approach is most appropriate?

Accepted Answer

Adopt the most restrictive controls from all applicable regulations. When multiple regulations apply simultaneously, the correct engineering approach is to adopt the most restrictive controls from each applicable regulation, because a control that satisfies the strictest requirement generally satisfies the looser ones as well. This avoids building parallel compliance silos and produces a single unified control set that is defensible to every auditor. HIPAA sets a floor, not a ceiling, and local privacy laws (e.g., GDPR, state statutes) may impose stricter breach notification, consent, or data-residency rules that must also be met.

Answer

Prioritize HIPAA over local laws

Answer

Follow only the most recent regulation

Answer

Create separate modules for each regulation

Question 6

Which THREE categories are typically used to classify security requirements?

Accepted Answer

Confidentiality. Security requirements are generally grouped by confidentiality, integrity, and availability (the CIA triad).

Answer

Project Profitability

Answer

Marketing Appeal

Question 7

What is the primary goal of performing a 'Security Gap Analysis' during the requirements phase?

Accepted Answer

To identify missing security controls against a baseline or standard. A gap analysis compares the existing state or desired requirements against security standards to identify missing controls.

Answer

To find bugs in the application code

Answer

To calculate the ROI of security spending

Answer

To document the project budget

Question 8

Which TWO of the following are primary benefits of including security requirements early in the SDLC?

Accepted Answer

Reduces the total cost of remediation. Option A is correct because addressing security requirements during early SDLC phases (such as requirements and design) allows flaws to be identified and fixed before code is written or deployed, and defects found later in production or even in testing are dramatically more expensive to remediate — this is the well-established "shift left" cost curve. Option B is correct because incorporating security requirements early ensures that security controls and architecture are designed to support the organization's business objectives, compliance obligations, and risk tolerance rather than being bolted on afterward, keeping security aligned with business requirements. Option C is incorrect because penetration testing remains a necessary validation activity regardless of when security requirements are introduced; early requirements reduce but never eliminate the need for adversarial testing. Option D is incorrect because security requirements typically increase documentation (policies, threat models, control mappings, test evidence) rather than reduce it. Option E is incorrect because security testing cannot be removed — early requirements complement, not replace, verification and validation activities such as SAST, DAST, and penetration testing.

Answer

Eliminates the need for penetration testing

Answer

Reduces the amount of documentation required

Answer

Allows for the removal of all security testing

Question 9

Which THREE items should be included in a 'Security Requirements Traceability Matrix'?

Accepted Answer

Associated project feature or module. A Security Requirements Traceability Matrix (SRTM) maps each security requirement to the parts of the system that implement it, so the associated project feature or module (A) is correct because it identifies where the requirement is realized. The test case or verification method (B) is correct because the SRTM must show how each requirement will be validated or verified, providing bidirectional traceability from requirement to test. The unique security requirement ID (D) is correct because a stable identifier is the key that links the requirement to its feature, test, and status throughout the lifecycle. The developer's annual salary (C) is a personnel/HR cost detail with no traceability value, and the vendor's hardware serial numbers (E) are asset inventory data, not requirement-to-implementation or requirement-to-verification mappings, so neither belongs in an SRTM.

Answer

The developer's annual salary

Answer

The vendor's hardware serial numbers

Question 10

Which THREE factors must be considered when defining 'Compliance Requirements' for an international software product?

Accepted Answer

Data residency and sovereignty laws. Data residency and sovereignty laws (A) are essential because they dictate where data may be stored and processed, directly shaping architecture and compliance obligations for an international product. Industry-specific standards such as PCI DSS and HIPAA (B) impose mandatory security and handling controls whenever the product processes payment card data or protected health information. Privacy regulations like GDPR and CCPA (C) define lawful processing, consent, data subject rights, and cross-border transfer rules that must be built into the product. By contrast, the developers' preferred coding language (D) is an implementation preference with no bearing on regulatory compliance, and the marketing budget (E) is a business/financial matter unrelated to defining compliance requirements.

Answer

The preferred coding language of the developers

Answer

The marketing budget of the product

Question 11

Which TWO methods are effective for eliciting security requirements from non-technical business stakeholders?

Accepted Answer

Presenting misuse case scenarios. Option A (Presenting misuse case scenarios) is correct because misuse cases describe how an actor could abuse or attack a system in business language, letting non-technical stakeholders articulate what must be prevented and thereby surface security requirements without requiring technical expertise. Option C (Conducting risk impact workshops) is correct because facilitated workshops let business stakeholders identify assets, threats, and the business impact of adverse events, translating their domain knowledge into prioritized security requirements. Option B (Analyzing server log architecture) is not appropriate here since it is a technical infrastructure activity that non-technical business stakeholders cannot meaningfully contribute to. Option D (Reviewing raw packet captures) is likewise a deep technical task requiring protocol-level knowledge, not a business elicitation technique. Option E (Reading the OWASP Top 10 documentation) is a reference standard for common web application risks, but passively reading it does not actively elicit requirements from non-technical stakeholders.

Answer

Analyzing server log architecture

Answer

Reviewing raw packet captures

Answer

Reading the OWASP Top 10 documentation

Question 12

Which TWO factors are critical when identifying compliance requirements for software that processes cross-border financial transactions?

Accepted Answer

Anti-Money Laundering (AML) regulations. Option C (Anti-Money Laundering (AML) regulations) is correct because cross-border financial transaction software must comply with AML rules such as customer due diligence, suspicious activity reporting, and transaction monitoring, which are legally mandated in most jurisdictions. Option E (Financial data privacy laws in all jurisdictions) is correct because processing financial data across borders means the software must satisfy each country's data protection and privacy requirements, such as GDPR, PIPEDA, or LGPD, including rules on cross-border data transfers. Option A (social media marketing strategy) is irrelevant because marketing does not determine legal compliance obligations for financial transaction processing. Option B (office paint color standards) is irrelevant because workplace aesthetics have no bearing on financial regulatory compliance. Option D (the developer's preferred IDE) is irrelevant because a development tool choice does not affect compliance requirements.

Answer

The social media marketing strategy

Answer

Office paint color standards

Answer

The developer's preferred IDE

Question 13

When updating requirements for a legacy system to improve its security posture, which THREE actions should the CSSLP prioritize?

Accepted Answer

Replacing deprecated cryptographic libraries. Option B is correct because deprecated cryptographic libraries (e.g., MD5, SHA-1, RC4, or outdated TLS stacks) contain known weaknesses and unpatched CVEs, so replacing them with current, supported algorithms and libraries directly reduces exploitable cryptographic risk in a legacy system. Option C is correct because implementing modern multi-factor authentication (e.g., TOTP, FIDO2/WebAuthn, or hardware tokens) strengthens identity assurance and mitigates credential-based attacks such as password reuse, phishing, and brute force, which are common weaknesses in legacy authentication schemes. Option E is correct because hardening against known injection attacks (SQL injection, command injection, LDAP injection, XSS) addresses the most prevalent and dangerous vulnerability classes in legacy code, typically via parameterized queries, input validation, and output encoding. Option A does not belong because changing internal team structure is an organizational/HR matter that does not directly improve the technical security posture of the system. Option D does not belong because increasing application server memory is a performance/scalability change with no direct security benefit.

Answer

Changing the internal team structure

Answer

Increasing the memory of the application servers

Question 14

You are a security architect for a FinTech startup building a mobile payment app. The product owner has provided a list of functional user stories but no security requirements. You need to integrate security into the Agile development process without disrupting the sprint cadence. Which approach BEST ensures security requirements are identified and documented continuously?

Accepted Answer

Define security requirements as acceptance criteria within each user story and refine them during backlog grooming.. Integrating security requirements as acceptance criteria within user stories ensures they are continuously identified, refined, and validated throughout the Agile lifecycle. This approach aligns security with business value, promotes collaboration, and makes security a natural part of the definition of done. Other approaches either delay security consideration or isolate it from the development flow, reducing effectiveness.

Answer

Assign a dedicated security champion to write security requirements for each sprint after the sprint planning meeting.

Answer

Conduct a comprehensive security requirements workshop at the project initiation and document all requirements in a separate security requirements specification.

Answer

Rely on the QA team to identify security requirements during test case creation for each user story.

Question 15

You are eliciting security requirements for a new online banking application. The business stakeholders are focused on features and have limited security knowledge. You need to ensure that security requirements are complete, unambiguous, and testable. Which technique is MOST appropriate to achieve this?

Accepted Answer

Create misuse cases that describe how an attacker might abuse the system, and derive security requirements from them.. Misuse cases are particularly effective for eliciting security requirements from stakeholders with limited security expertise. By framing threats as stories of misuse, they make abstract security concepts concrete and relatable. This technique ensures that requirements are derived from actual attack scenarios, making them specific, testable, and directly tied to risk mitigation. It also fosters collaboration between security and business stakeholders.

Answer

Organize a focus group where stakeholders brainstorm all possible security features they want in the application.

Answer

Interview the IT security team to document their existing security policies and apply them as requirements.

Answer

Conduct a survey asking stakeholders to rate the importance of various security controls from a predefined list.