Secure Software Requirements

When designing a system that must satisfy both HIPAA and local privacy laws, which requirement approach is most appropriate?

You are leading a threat modeling session for a new cloud-native application. You identify a potential threat where an attacker attempts to inject malicious SQL queries into the search bar. Which technique should you employ to document this behavior during the Secure Software Requirements phase?

A stakeholder requests a feature that allows users to bypass password complexity requirements for 'internal testing accounts.' As a CSSLP, what is your first step in requirements analysis?

Which THREE items should be included in a 'Security Requirements Traceability Matrix'?

You are determining compliance requirements for a software product that handles PII. Which requirement is essential for demonstrating 'Privacy by Design'?

Which THREE categories are typically used to classify security requirements?

In the context of 'Secure Software Requirements', what should the security team do when they encounter a conflict between usability and security?

What is the primary goal of performing a 'Security Gap Analysis' during the requirements phase?

Which document is essential to map regulatory compliance requirements to specific software features?

Which TWO factors are critical when identifying compliance requirements for software that processes cross-border financial transactions?

Which phase of the secure software lifecycle is the most cost-effective for identifying and correcting security requirements?

Which THREE factors must be considered when defining 'Compliance Requirements' for an international software product?

When updating requirements for a legacy system to improve its security posture, which THREE actions should the CSSLP prioritize?

When gathering security requirements, what is the primary challenge when dealing with 'shadow IT' within a large enterprise?

During a project migration to GDPR compliance, the development team must ensure that personal data is deleted upon user request. Where should these specific data lifecycle constraints be documented to ensure they influence the architectural design?

An application requires multi-factor authentication (MFA) for administrative access. During requirements gathering, the security team determines that SMS-based MFA is insufficient for high-risk accounts. What documentation artifact should reflect this specific requirement?

You are reviewing the requirements for a legacy system integration. The system currently transmits credentials over plaintext protocols. What is the priority for the security requirements phase?

Which TWO inputs are most important when developing 'Abuse Cases'?

Which TWO methods are effective for eliciting security requirements from non-technical business stakeholders?

When gathering requirements for a new healthcare application, which regulation must be consulted to ensure the proper handling of Protected Health Information (PHI)?

You are managing requirements for a distributed microservices application. You need to ensure that service-to-service communication is encrypted. Which requirement type best categorizes this constraint?

You are eliciting security requirements for an application that must comply with PCI-DSS. What is the most effective way to identify the scope of the systems requiring the highest level of security?

You are analyzing an application to prevent unauthorized API access. Which requirement elicitation technique is best suited to identify potential entry points that an attacker might exploit?

Which TWO of the following are primary benefits of including security requirements early in the SDLC?

Which of the following describes the purpose of 'misuse case' modeling?

A government client requires that all software be validated against FIPS 140-3 standards. During requirements gathering, what is the most important step for the cryptographic module implementation?