CASE Security Requirements Gathering

Question 1

At which SDLC phase is it most cost-effective to define security requirements?

Accepted Answer

During requirements gathering at the start

Answer

Fixing security defects costs far more the later they are found. Defining security requirements at the start builds security in rather than adding it afterwards.

Question 2

What is a misuse case (abuse case) in security requirements gathering?

Accepted Answer

A scenario describing how an attacker could deliberately misuse the system's functionality

Answer

Misuse cases are the opposite of use cases. They model hostile actors and their goals, which helps identify security requirements that the system needs to counter them.

Question 3

Which requirement is a well-formed, testable security requirement?

Accepted Answer

The system shall lock an account for 15 minutes after 5 consecutive failed login attempts

Answer

A good security requirement is specific, measurable and testable. Vague statements like 'should be secure' can't be verified.

Question 4

Which OWASP resource is designed specifically as a source of verifiable application security requirements?

Accepted Answer

OWASP Application Security Verification Standard (ASVS)

Answer

ASVS provides tiered (L1–L3), testable security requirements that teams can adopt as their requirements baseline. ZAP and Dependency-Check are testing tools, and Juice Shop is a training app.

Question 5

Which of these is a typical SOURCE of security requirements?

Accepted Answer

Regulatory and compliance mandates such as PCI DSS, HIPAA or GDPR

Answer

Security requirements come from regulations, industry standards, organizational policies, business risk and threat analysis. Compliance mandates are a primary driver.

(CASE) Certified Application Security Engineer Practice Test

(CASE) Certified Application Security Engineer Practice Test

CASE Security Requirements Gathering