Secure Software Requirements

A software company is developing a cloud-based collaboration platform that will be used by government agencies. The platform must adhere to FedRAMP requirements. The security team is defining security requirements and needs to ensure that data in transit is protected. Which of the following requirements is MOST appropriate to include in the security requirements specification to meet FedRAMP requirements?

When designing a system that must satisfy both HIPAA and local privacy laws, which requirement approach is most appropriate?

You are leading a threat modeling session for a new cloud-native application. You identify a potential threat where an attacker attempts to inject malicious SQL queries into the search bar. Which technique should you employ to document this behavior during the Secure Software Requirements phase?

A stakeholder requests a feature that allows users to bypass password complexity requirements for 'internal testing accounts.' As a CSSLP, what is your first step in requirements analysis?

Which THREE items should be included in a 'Security Requirements Traceability Matrix'?

You are determining compliance requirements for a software product that handles PII. Which requirement is essential for demonstrating 'Privacy by Design'?

Which THREE categories are typically used to classify security requirements?

In the context of 'Secure Software Requirements', what should the security team do when they encounter a conflict between usability and security?

What is the primary goal of performing a 'Security Gap Analysis' during the requirements phase?

Which document is essential to map regulatory compliance requirements to specific software features?

Which TWO factors are critical when identifying compliance requirements for software that processes cross-border financial transactions?

Which phase of the secure software lifecycle is the most cost-effective for identifying and correcting security requirements?

Which THREE factors must be considered when defining 'Compliance Requirements' for an international software product?

You are eliciting security requirements for a new online banking application. The business stakeholders are focused on features and have limited security knowledge. You need to ensure that security requirements are complete, unambiguous, and testable. Which technique is MOST appropriate to achieve this?

When updating requirements for a legacy system to improve its security posture, which THREE actions should the CSSLP prioritize?

When gathering security requirements, what is the primary challenge when dealing with 'shadow IT' within a large enterprise?

During a project migration to GDPR compliance, the development team must ensure that personal data is deleted upon user request. Where should these specific data lifecycle constraints be documented to ensure they influence the architectural design?

An application requires multi-factor authentication (MFA) for administrative access. During requirements gathering, the security team determines that SMS-based MFA is insufficient for high-risk accounts. What documentation artifact should reflect this specific requirement?

You are a security analyst tasked with reviewing a set of security requirements for a new web application. One requirement states: 'The application must be secure.' What is the PRIMARY issue with this requirement?

You are reviewing the requirements for a legacy system integration. The system currently transmits credentials over plaintext protocols. What is the priority for the security requirements phase?

Which TWO inputs are most important when developing 'Abuse Cases'?

Which TWO methods are effective for eliciting security requirements from non-technical business stakeholders?

When gathering requirements for a new healthcare application, which regulation must be consulted to ensure the proper handling of Protected Health Information (PHI)?

You are leading a requirements elicitation session for a new EHR system. A stakeholder from the legal department insists that the system must comply with HIPAA. Another stakeholder from the clinical team wants quick access to patient records for emergency situations. You need to document a security requirement that balances these needs. Which requirement BEST addresses both compliance and usability?

You are managing requirements for a distributed microservices application. You need to ensure that service-to-service communication is encrypted. Which requirement type best categorizes this constraint?

You are eliciting security requirements for an application that must comply with PCI-DSS. What is the most effective way to identify the scope of the systems requiring the highest level of security?

You are a security architect for a FinTech startup building a mobile payment app. The product owner has provided a list of functional user stories but no security requirements. You need to integrate security into the Agile development process without disrupting the sprint cadence. Which approach BEST ensures security requirements are identified and documented continuously?

A healthcare software development team is building a patient portal that must comply with HIPAA. The team has completed a risk assessment and identified several potential threats. They now need to translate these findings into actionable security requirements. Which of the following is the MOST effective approach to ensure that the security requirements adequately address the identified risks?

You are analyzing an application to prevent unauthorized API access. Which requirement elicitation technique is best suited to identify potential entry points that an attacker might exploit?

Which TWO of the following are primary benefits of including security requirements early in the SDLC?

Which of the following describes the purpose of 'misuse case' modeling?

A software development team is creating a new e-commerce application. During requirements elicitation, the security architect suggests using misuse cases to identify security requirements. Which of the following BEST describes the primary purpose of misuse cases in this context?

A government client requires that all software be validated against FIPS 140-3 standards. During requirements gathering, what is the most important step for the cryptographic module implementation?