CCNA Secure Software Requirements Questions

MCQhard

When designing a system that must satisfy both HIPAA and local privacy laws, which requirement approach is most appropriate?

A.Prioritize HIPAA over local laws

B.Follow only the most recent regulation

C.Create separate modules for each regulation

D.Adopt the most restrictive controls from all applicable regulations

AnswerD

This ensures that all regulatory standards are met simultaneously.

Why this answer

When multiple regulations apply, the software must satisfy the most restrictive requirements of each to ensure full compliance.

Practice this question →

MCQmedium

You are leading a threat modeling session for a new cloud-native application. You identify a potential threat where an attacker attempts to inject malicious SQL queries into the search bar. Which technique should you employ to document this behavior during the Secure Software Requirements phase?

A.Attack Tree Analysis

B.Misuse Case Modeling

C.Data Flow Diagramming

D.Compliance Matrix Mapping

AnswerB

Misuse cases explicitly define the interaction between an actor and the system to identify unauthorized or malicious actions.

Why this answer

Abuse cases are specifically designed to describe how an attacker might interact with the system to achieve a malicious objective, making them the correct tool for documenting such threats during requirements gathering.

Practice this question →

MCQmedium

A stakeholder requests a feature that allows users to bypass password complexity requirements for 'internal testing accounts.' As a CSSLP, what is your first step in requirements analysis?

A.Document the risk and perform a formal risk assessment

B.Immediately reject the request

C.Update the password policy

D.Implement the bypass in dev only

AnswerA

Performing a risk assessment allows stakeholders to understand the impact of the exception before a final decision.

Why this answer

Analyzing the risk versus the business need is the standard procedure when a requirement violates security policy.

Practice this question →

Multi-Selectmedium

Which THREE items should be included in a 'Security Requirements Traceability Matrix'?

Select 3 answers

A.Associated project feature or module

B.Test case or verification method

C.The developer's annual salary

D.Unique security requirement ID

E.The vendor's hardware serial numbers

AnswersA, B, D

This maps the security requirement to the actual software component.

Why this answer

A matrix needs to link the requirement, its implementation, and the verification method used to confirm it.

Practice this question →

MCQhard

You are determining compliance requirements for a software product that handles PII. Which requirement is essential for demonstrating 'Privacy by Design'?

A.Use the largest possible key size

B.Implement full data retention

C.Outsource all PII processing

D.Enforce data minimization throughout the lifecycle

AnswerD

Data minimization is a foundational element of privacy by design under regulations like GDPR.

Why this answer

Data minimization is a core principle of Privacy by Design, ensuring only necessary data is collected.

Practice this question →

Multi-Selecteasy

Which THREE categories are typically used to classify security requirements?

Select 3 answers

A.Confidentiality

B.Project Profitability

C.Integrity

D.Availability

E.Marketing Appeal

AnswersA, C, D

Protecting data privacy is a core requirement category.

Why this answer

Security requirements are generally grouped by confidentiality, integrity, and availability (the CIA triad).

Practice this question →

MCQmedium

In the context of 'Secure Software Requirements', what should the security team do when they encounter a conflict between usability and security?

A.Ignore the usability concern

B.Always prioritize security over usability

C.Conduct a risk-based assessment to find a balanced approach

D.Ask the developers to make the final decision

AnswerC

A risk-based approach allows for informed trade-offs that maintain security without destroying usability.

Why this answer

Security requirements must be balanced with usability; the team should seek a solution that satisfies both if possible, or perform a risk assessment.

Practice this question →

MCQeasy

What is the primary goal of performing a 'Security Gap Analysis' during the requirements phase?

A.To find bugs in the application code

B.To calculate the ROI of security spending

C.To document the project budget

D.To identify missing security controls against a baseline or standard

AnswerD

This is the definition of a gap analysis.

Why this answer

A gap analysis compares the existing state or desired requirements against security standards to identify missing controls.

Practice this question →

MCQeasy

Which document is essential to map regulatory compliance requirements to specific software features?

A.Security Requirements Traceability Matrix (SRTM)

B.System Architecture Document

C.Incident Response Plan

D.Software Development Plan

AnswerA

The SRTM is the specific document used to track compliance requirements to features.

Why this answer

A Traceability Matrix is the standard tool for showing the relationship between regulatory requirements and technical implementation.

Practice this question →

Multi-Selectmedium

Which TWO factors are critical when identifying compliance requirements for software that processes cross-border financial transactions?

Select 2 answers

A.The social media marketing strategy

B.Office paint color standards

C.Anti-Money Laundering (AML) regulations

D.The developer's preferred IDE

E.Financial data privacy laws in all jurisdictions

AnswersC, E

Financial software must adhere to AML/KYC laws.

Why this answer

Cross-border finance requires compliance with both anti-money laundering (AML) laws and strict financial data protection regulations.

Practice this question →

MCQeasy

Which phase of the secure software lifecycle is the most cost-effective for identifying and correcting security requirements?

A.Maintenance phase

B.Deployment phase

C.Requirements phase

D.Testing phase

AnswerC

Fixing issues during requirements is significantly cheaper than in testing or production.

Why this answer

The earlier a requirement gap is identified, the cheaper it is to fix (before design or coding begins).

Practice this question →

Multi-Selecthard

Which THREE factors must be considered when defining 'Compliance Requirements' for an international software product?

Select 3 answers

A.Data residency and sovereignty laws

B.Industry-specific standards (e.g., PCI, HIPAA)

C.Privacy regulations (e.g., GDPR, CCPA)

D.The preferred coding language of the developers

E.The marketing budget of the product

AnswersA, B, C

Different countries have strict rules about where data can be stored.

Why this answer

International software must navigate local data sovereignty, specific industry standards, and varying regulatory privacy frameworks.

Practice this question →

Multi-Selecthard

When updating requirements for a legacy system to improve its security posture, which THREE actions should the CSSLP prioritize?

Select 3 answers

A.Changing the internal team structure

B.Replacing deprecated cryptographic libraries

C.Implementing modern, multi-factor authentication

D.Increasing the memory of the application servers

E.Hardening the system against known injection attacks

AnswersB, C, E

Legacy systems often use weak, broken crypto that must be updated.

Why this answer

Upgrading legacy systems requires a focus on replacing insecure dependencies, implementing modern authentication, and ensuring the interface is hardened against current threats.

Practice this question →

MCQmedium

When gathering security requirements, what is the primary challenge when dealing with 'shadow IT' within a large enterprise?

A.Slow deployment speeds

B.Lack of visibility and consistent security enforcement

C.High infrastructure costs

D.Excessive user training

AnswerB

Because they are outside the lifecycle, security requirements are neither defined nor enforced.

Why this answer

Shadow IT systems operate outside of managed security requirements, making it difficult to ensure they meet corporate compliance or security standards.

Practice this question →

MCQhard

During a project migration to GDPR compliance, the development team must ensure that personal data is deleted upon user request. Where should these specific data lifecycle constraints be documented to ensure they influence the architectural design?

A.The Software Requirements Specification (SRS)

B.The Penetration Testing Report

C.The Infrastructure-as-Code (IaC) templates

D.The Risk Register

AnswerA

The SRS is the formal document where security and privacy constraints must be embedded to ensure they are implemented.

Why this answer

Security requirements must be integrated into the Software Requirements Specification (SRS) or the project's requirements management tool (like Jira or Azure DevOps) to ensure they are tracked as functional constraints.

Practice this question →

MCQmedium

An application requires multi-factor authentication (MFA) for administrative access. During requirements gathering, the security team determines that SMS-based MFA is insufficient for high-risk accounts. What documentation artifact should reflect this specific requirement?

A.Threat Intelligence Feed

B.Change Request Log

C.Security Requirements Traceability Matrix (SRTM)

D.Project Charter

AnswerC

The SRTM links security requirements to specific features and business goals, ensuring technical decisions are documented.

Why this answer

A security constraint or non-functional requirement document defines specific technical standards that the solution must meet.

Practice this question →

MCQhard

You are reviewing the requirements for a legacy system integration. The system currently transmits credentials over plaintext protocols. What is the priority for the security requirements phase?

A.Request a waiver for the legacy system

B.Suggest the use of a VPN for the entire network

C.Document the legacy protocol as a technical debt item

D.Mandate the migration to an encrypted transport layer in the SRS

AnswerD

Defining the mandatory security control (TLS) as a functional requirement ensures it is implemented during development.

Why this answer

The primary objective of security requirements is to eliminate known vulnerabilities at the design stage, which means mandating modern protocols (like TLS 1.3) as a requirement.

Practice this question →

Multi-Selecteasy

Which TWO inputs are most important when developing 'Abuse Cases'?

Select 2 answers

A.System functional requirements

B.The annual maintenance budget

C.Developer performance metrics

D.Known threat intelligence and past incident history

E.The internal office floor plan

AnswersA, D

You must understand what the system does to determine how to abuse it.

Why this answer

Abuse cases require understanding the system's intended functions and the threat landscape, usually through threat models.

Practice this question →

Multi-Selecthard

Which TWO methods are effective for eliciting security requirements from non-technical business stakeholders?

Select 2 answers

A.Presenting misuse case scenarios

B.Analyzing server log architecture

C.Conducting risk impact workshops

D.Reviewing raw packet captures

E.Reading the OWASP Top 10 documentation

AnswersA, C

Relatable stories about system compromise are effective for eliciting business needs.

Why this answer

Non-technical stakeholders respond best to scenarios and high-level risk examples rather than technical documentation.

Practice this question →

MCQeasy

When gathering requirements for a new healthcare application, which regulation must be consulted to ensure the proper handling of Protected Health Information (PHI)?

A.GDPR

B.FISMA

C.HIPAA

D.SOX

AnswerC

HIPAA sets the requirements for protecting PHI within healthcare software.

Why this answer

HIPAA (Health Insurance Portability and Accountability Act) is the primary regulation for securing PHI in the United States.

Practice this question →

MCQhard

You are managing requirements for a distributed microservices application. You need to ensure that service-to-service communication is encrypted. Which requirement type best categorizes this constraint?

A.Non-functional security requirement

B.Functional requirement

C.Business rule

D.Use case description

AnswerA

Encryption constraints are properties of the system architecture that qualify as non-functional requirements.

Why this answer

Security requirements are often classified as non-functional requirements because they define how the system performs or behaves rather than what specific business function it provides.

Practice this question →

MCQeasy

You are eliciting security requirements for an application that must comply with PCI-DSS. What is the most effective way to identify the scope of the systems requiring the highest level of security?

A.Perform a network vulnerability scan

B.Map the data flow of credit card information

C.Review the application source code

D.Update the firewall rule set

AnswerB

Mapping data flows identifies exactly which components interact with sensitive data, defining the compliance scope.

Why this answer

PCI-DSS requires identifying the Cardholder Data Environment (CDE) to define the scope of compliance, which is the most critical first step.

Practice this question →

MCQmedium

You are analyzing an application to prevent unauthorized API access. Which requirement elicitation technique is best suited to identify potential entry points that an attacker might exploit?

A.User Story Mapping

B.Abuse Case Modeling

C.Compliance Gap Analysis

D.Cost-Benefit Analysis

AnswerB

Abuse cases help identify how a user might maliciously leverage an API endpoint.

Why this answer

Abuse case analysis is specifically focused on identifying entry points and malicious usage paths during the requirements phase.

Practice this question →

Multi-Selectmedium

Which TWO of the following are primary benefits of including security requirements early in the SDLC?

Select 2 answers

A.Reduces the total cost of remediation

B.Ensures security architecture is aligned with business requirements

C.Eliminates the need for penetration testing

D.Reduces the amount of documentation required

E.Allows for the removal of all security testing

AnswersA, B

Fixing defects early is significantly cheaper.

Why this answer

Early integration reduces cost and ensures security is baked into the architecture, not bolted on.

Practice this question →

MCQeasy

Which of the following describes the purpose of 'misuse case' modeling?

A.To ensure user interface guidelines are followed

B.To describe scenarios where the system is used to cause harm

C.To identify all potential bugs in the code

D.To document the project timeline

AnswerB

This is the core definition of a misuse case in security requirements engineering.

Why this answer

Misuse cases identify threats by describing how an actor can misuse the system to create a negative impact.

Practice this question →

MCQhard

A government client requires that all software be validated against FIPS 140-3 standards. During requirements gathering, what is the most important step for the cryptographic module implementation?

A.Ensure all cryptographic modules are FIPS-validated

B.Implement multi-party authorization

C.Develop custom encryption algorithms

D.Encrypt all databases at rest

AnswerA

Compliance requires the specific modules to be certified as meeting the FIPS standard.

Why this answer

FIPS 140-3 validates the specific cryptographic modules used; therefore, the requirement must mandate the use of pre-validated modules.

Practice this question →