CSSLP Secure Software Requirements — Timed 10 Questions

Question 1

You are defining security requirements for a new IoT device that will collect and transmit sensor data to a cloud backend. You need to ensure that the requirements address data protection in transit and at rest. (Choose two.)

10 minute time limit — choose an answer to begin.

Accepted Answer

The cloud backend must store all received data in an encrypted database using transparent data encryption (TDE).. The two requirements that directly address data protection are encrypting sensor data before transmission (protecting data in transit) and encrypting stored data in the cloud database (protecting data at rest). Together, they ensure confidentiality throughout the data lifecycle. The other options focus on device integrity, access control, or authentication, which are important but do not specifically protect the data itself from unauthorized disclosure.

Answer

The device must use a unique, per-device certificate for mutual authentication with the cloud.

Answer

The cloud backend must enforce role-based access control (RBAC) for all users accessing the sensor data.

Answer

The device must implement a secure boot process to verify firmware integrity before operation.

Question 2

A financial services company is developing a mobile banking application that must comply with PCI DSS. The security team is defining security requirements and needs to ensure that authentication mechanisms meet regulatory and business needs. Which TWO of the following requirements are MOST appropriate to include in the security requirements specification? (Choose two.)

Accepted Answer

The application must enforce multi-factor authentication for all users accessing sensitive account information.. The two most appropriate requirements are enforcing multi-factor authentication for sensitive access and securely storing authentication credentials. These directly address PCI DSS requirements for access control and data protection. Other options either weaken security, are insufficient alone, or focus on detective rather than preventive controls.

Answer

The application must log all authentication attempts and store logs for at least 30 days.

Answer

The application must implement a password complexity policy that requires at least 8 characters with a mix of letters and numbers.

Answer

The application must allow users to authenticate using only a username and password to simplify the user experience.

Question 3

You are eliciting security requirements for an application that must comply with PCI-DSS. What is the most effective way to identify the scope of the systems requiring the highest level of security?

Accepted Answer

Map the data flow of credit card information. PCI-DSS requires identifying the Cardholder Data Environment (CDE) to define the scope of compliance, which is the most critical first step.

Answer

Perform a network vulnerability scan

Answer

Review the application source code

Answer

Update the firewall rule set

Question 4

A stakeholder requests a feature that allows users to bypass password complexity requirements for 'internal testing accounts.' As a CSSLP, what is your first step in requirements analysis?

Accepted Answer

Document the risk and perform a formal risk assessment. A CSSLP's role in requirements analysis is to surface and quantify security risk, not to unilaterally veto business requests. Documenting the risk and performing a formal risk assessment gives stakeholders the information needed to make an informed accept/mitigate/reject decision, preserving the requirements-engineering process. This aligns with CSSLP's emphasis on integrating risk management into the SDLC rather than acting as a gatekeeper.

Answer

Immediately reject the request

Answer

Update the password policy

Answer

Implement the bypass in dev only

Question 5

When gathering requirements for a new healthcare application, which regulation must be consulted to ensure the proper handling of Protected Health Information (PHI)?

Accepted Answer

HIPAA. HIPAA (Health Insurance Portability and Accountability Act) is the U.S. federal law governing the privacy and security of Protected Health Information (PHI), including the Privacy Rule, Security Rule, and Breach Notification Rule. Any application handling PHI for a covered entity or business associate must comply with HIPAA's administrative, physical, and technical safeguards.

Answer

GDPR

Answer

FISMA

Answer

SOX

Question 6

An application requires multi-factor authentication (MFA) for administrative access. During requirements gathering, the security team determines that SMS-based MFA is insufficient for high-risk accounts. What documentation artifact should reflect this specific requirement?

Accepted Answer

Security Requirements Traceability Matrix (SRTM). The Security Requirements Traceability Matrix (SRTM) is the documentation artifact that maps each security requirement to its source, design, implementation, and test evidence. Since the security team has determined that SMS-based MFA is insufficient for high-risk administrative accounts, this specific requirement must be captured and traced through the SDLC. The SRTM ensures the requirement is not lost and can be verified during testing and audit.

Answer

Threat Intelligence Feed

Answer

Change Request Log

Answer

Project Charter

Question 7

You are managing requirements for a distributed microservices application. You need to ensure that service-to-service communication is encrypted. Which requirement type best categorizes this constraint?

Accepted Answer

Non-functional security requirement. Encryption of service-to-service traffic is a quality attribute describing how the system behaves, not a specific function it performs, so it is a non-functional security requirement. It constrains the architecture (e.g., mTLS, TLS 1.3) rather than describing a user-visible behavior. CSSLP categorizes such constraints as non-functional requirements that shape design and verification.

Answer

Functional requirement

Answer

Business rule

Answer

Use case description

Question 8

During a project migration to GDPR compliance, the development team must ensure that personal data is deleted upon user request. Where should these specific data lifecycle constraints be documented to ensure they influence the architectural design?

Accepted Answer

The Software Requirements Specification (SRS). Security requirements must be integrated into the Software Requirements Specification (SRS) or the project's requirements management tool (like Jira or Azure DevOps) to ensure they are tracked as functional constraints.

Answer

The Penetration Testing Report

Answer

The Infrastructure-as-Code (IaC) templates

Answer

The Risk Register

Question 9

You are reviewing the requirements for a legacy system integration. The system currently transmits credentials over plaintext protocols. What is the priority for the security requirements phase?

Accepted Answer

Mandate the migration to an encrypted transport layer in the SRS. The security requirements phase is where security controls are formally specified in the Software Requirements Specification (SRS). Since the legacy system transmits credentials in plaintext, the priority is to mandate a secure replacement—encrypted transport (e.g., TLS/SSL, SSH, or IPsec)—as a requirement in the SRS. This ensures the security need is captured, tracked, and implemented, rather than deferred or mitigated only at the network level. Documenting technical debt or requesting a waiver does not fix the vulnerability; it merely acknowledges it.

Answer

Request a waiver for the legacy system

Answer

Suggest the use of a VPN for the entire network

Answer

Document the legacy protocol as a technical debt item

Question 10

You are leading a threat modeling session for a new cloud-native application. You identify a potential threat where an attacker attempts to inject malicious SQL queries into the search bar. Which technique should you employ to document this behavior during the Secure Software Requirements phase?

Accepted Answer

Misuse Case Modeling. Misuse case modeling documents how a system can be misused by an actor (the misuser) to achieve a malicious goal, which is exactly what is needed to capture an attacker injecting SQL into a search bar during the Secure Software Requirements phase. It complements use cases by describing negative behavior and is used to derive security requirements and test cases. Attack trees are better suited to decomposing a high-level attack goal into sub-goals during threat modeling, not for documenting a specific misuse scenario in requirements.

Answer

Attack Tree Analysis

Answer

Data Flow Diagramming

Answer

Compliance Matrix Mapping