CCNA Secure Software Requirements Questions

FedRAMP mandates the use of secure protocols such as TLS 1.2 or higher for data in transit, with FIPS 140-2 validated cryptographic modules. This requirement ensures confidentiality and integrity of data during transmission, directly aligning with FedRAMP controls. It is specific, verifiable, and meets the regulatory baseline.

Regulations overlap, so satisfying each independently leaves gaps. Adopting the most restrictive control for every requirement ensures compliance with all applicable laws simultaneously, since meeting the strictest threshold inherently satisfies the looser obligations of the others.

Misuse case modelling documents adversarial goals against legitimate functionality, capturing the attacker's SQL injection intent as a structured abuse scenario. This satisfies the Secure Software Requirements phase constraint by recording the threat's behaviour during requirements, before design or code exists, so mitigations such as parameterised queries can be specified as explicit security requirements.

Bypassing password complexity for internal testing accounts introduces an authentication weakness that may reach production. Documenting the risk and performing a formal risk assessment satisfies the CSSLP requirement to analyse and quantify security impact before accepting, mitigating or rejecting the stakeholder's request through governance.

Mapping each security requirement to the feature or module that implements it establishes traceability between stated security needs and delivered functionality, satisfying the matrix's purpose of proving coverage and exposing requirements with no corresponding implementation.

Privacy by Design requires limiting collection and retention to what is strictly necessary. Enforcing data minimisation across the entire lifecycle — collection, processing, storage and disposal — reduces exposure of PII, directly satisfying the proactive, embedded privacy constraint the stem demands rather than bolting controls on afterwards.

Confidentiality is one of the three classic security requirement categories, alongside integrity and availability — the CIA triad. It directly satisfies the stem's demand for typical classification categories, as it addresses preventing unauthorised disclosure of information, a foundational objective that security requirements must express.

A risk-based assessment quantifies the exposure each usability trade-off introduces, letting the team select controls proportionate to identified threats rather than defaulting to maximum restriction. This satisfies the stem's requirement to resolve the conflict by weighing both concerns against actual business impact, producing a documented, defensible balance instead of an arbitrary preference.

Gap analysis compares current or planned controls against a chosen baseline such as ISO 27001 or OWASP ASVS, exposing absent or weak controls. That comparison output is what drives requirements, satisfying the stem's aim of identifying missing security controls during the requirements phase.

The SRTM links each regulatory obligation to the specific features and tests that satisfy it, providing bidirectional traceability so auditors can confirm coverage, which satisfies the need to map compliance requirements to concrete software functionality.

Cross-border financial transactions trigger AML obligations regardless of jurisdiction, since AML regimes criminalise laundering proceeds and mandate customer due diligence, transaction monitoring and suspicious activity reporting. This directly satisfies the stem's compliance-identification constraint for software handling such payments.

Requirements phase defects are cheapest to fix because no code or architecture exists yet. Identifying and correcting security requirements here prevents costly rework during design, coding and testing, satisfying the lifecycle constraint that earliest-phase remediation yields the greatest cost-effectiveness.

Data residency and sovereignty laws dictate where personal data may be stored and processed, varying by jurisdiction. For an international product, these legal constraints determine hosting regions, cross-border transfer mechanisms and data localisation, making them a primary compliance requirement.

Misuse cases are a structured technique to identify negative scenarios and derive security requirements. They help non-technical stakeholders understand threats by illustrating attacker goals, making it easier to elicit specific, testable requirements. This approach directly addresses completeness and unambiguity by forcing consideration of abuse scenarios and corresponding mitigations, which can be validated during testing.

Deprecated cryptographic libraries, such as MD5, SHA-1 or TLS 1.0, contain known weaknesses that attackers can exploit. Replacing them with current, supported algorithms and protocols removes those exploitable primitives, directly improving the legacy system's security posture at its foundational trust layer.

Shadow IT systems are procured and operated outside central governance, so security teams cannot inventory them, assess their configurations or apply consistent controls. This visibility gap prevents uniform policy enforcement across the enterprise, which is the core challenge when eliciting security requirements.

The Software Requirements Specification captures functional and non-functional constraints that architects must design against. Documenting GDPR erasure obligations there satisfies the stem's requirement by ensuring deletion timelines and data lifecycle rules are traceable, testable requirements rather than informal assumptions discovered after design.

The SRTM maps each security requirement to its design, code and test artefacts, so the SMS-MFA prohibition for high-risk accounts is recorded and verifiably traced. This satisfies the stem's documentation need, unlike a general security policy or design document that lacks traceability linkage.

A requirement must be verifiable to be useful. 'Secure' is subjective and cannot be measured or tested. Without specific criteria, such as encryption standards or authentication mechanisms, testers cannot determine if the requirement is met. This makes it impossible to validate during development or acceptance testing, leading to ambiguity and potential security gaps.

Requiring encrypted transport in the SRS removes plaintext credential transmission at its root, addressing the confidentiality breach directly during the security requirements phase. This satisfies the stated priority: the legacy integration currently exposes credentials, so mandating TLS or equivalent is the foundational control before further hardening.

Abuse cases invert legitimate behaviour, so they must derive from system functional requirements: each intended feature, input and workflow defines the misuse paths an attacker could exploit. This grounds abuse scenarios in the actual system scope rather than speculation.

Misuse case scenarios describe how an adversary could abuse a system, expressed in plain business language rather than technical controls. Non-technical stakeholders can reason about these narratives, surfacing security requirements they would struggle to articulate from abstract policy or configuration discussions.

HIPAA directly governs the handling of Protected Health Information in the United States, mandating administrative, physical and technical safeguards. Since the application processes PHI, its requirements must be captured during the requirements-gathering phase to ensure compliant data protection controls are designed in from the outset.

Break-glass access allows authorized clinicians to bypass normal access controls in emergencies, ensuring timely care. Logging and retrospective review maintain accountability and compliance with HIPAA's access control and audit requirements. This requirement balances usability (quick access) with security (audit and review), making it the best solution.

Encryption of service-to-service traffic constrains how the system behaves rather than what function it delivers, so it is a quality attribute, not a functional requirement. It specifies a security characteristic the microservices must exhibit, matching the non-functional category.

Mapping the cardholder data flow traces credit card information from entry through storage, processing and transmission, exposing every system, network segment and third party that touches it. This directly satisfies PCI-DSS scoping, which defines scope by where cardholder data resides or transits, so the highest-security controls land on precisely those components.

Embedding security requirements as acceptance criteria ensures they are addressed within the same sprint as the functional work. This approach integrates security into the existing Agile workflow, making security a definition-of-done item. It allows the team to verify security controls before story completion, reducing the risk of accumulating security debt and ensuring continuous security consideration.

A traceability matrix directly maps each identified threat to specific security requirements, ensuring that no threat is left unaddressed. It also provides a mechanism to verify that all requirements have been implemented and tested, which is critical for HIPAA compliance and auditability. This approach systematically closes the loop between risk assessment and requirement definition.

Abuse case modelling deliberately examines how an attacker would misuse functionality, exposing entry points such as unvalidated parameters and exposed endpoints. This satisfies the stem's goal of identifying exploitable API entry points, unlike use cases, which describe only intended legitimate behaviour.

Addressing flaws during design or coding costs far less than patching deployed systems, because remediation effort and blast radius both grow sharply after release. This directly satisfies the stem's cost constraint: early security requirements prevent expensive rework, unlike controls bolted on post-deployment.

Misuse cases invert the actor's intent, modelling an adversary or hostile insider deliberately abusing legitimate functionality to cause harm. This surfaces abuse and attack scenarios during requirements elicitation, complementing use cases that describe only intended, benign behaviour.

Misuse cases are a technique to model negative scenarios where an actor intentionally harms the system or exploits vulnerabilities. They help elicit security requirements by identifying what the system should prevent or detect. This proactive approach ensures that security is considered early in the lifecycle, aligning with CSSLP principles.

FIPS 140-3 validation is performed by an accredited laboratory against the standard, so only modules holding a valid certificate satisfy the client's mandate. Selecting validated modules during requirements gathering prevents later redesign when an unvalidated cryptographic library is discovered.