CSLLP Secure Software Requirements 2 — Questions and Answers
Question 1: What is the purpose of requirements traceability in secure software development?
- To track bugs from development to production
- To link security requirements to design decisions, code, and tests ensuring nothing is missed (Correct answer)
- To monitor runtime behavior of deployed applications
- To manage software licensing compliance
Correct answer: To link security requirements to design decisions, code, and tests ensuring nothing is missed
Requirements traceability ensures every security requirement can be traced forward to its implementation and test cases, confirming all requirements are addressed.
Question 2: Which of the following best describes personally identifiable information (PII)?
- Any data stored in a database
- Information that can be used to identify, contact, or locate a specific individual (Correct answer)
- Encrypted data that cannot be read without a key
- Any data transmitted over a network
Correct answer: Information that can be used to identify, contact, or locate a specific individual
PII is any information that can be used on its own or in combination with other information to identify, contact, or locate a single person.
Question 3: A system that processes payment card data must comply with which standard?
- HIPAA
- SOX
- PCI DSS (Correct answer)
- FERPA
Correct answer: PCI DSS
The Payment Card Industry Data Security Standard (PCI DSS) is a set of security requirements for organizations that store, process, or transmit cardholder data.
Question 4: What is the purpose of a data flow diagram (DFD) in security requirements analysis?
- To model database schema relationships
- To visualize how data moves through a system, identifying trust boundaries and sensitive data flows (Correct answer)
- To document API endpoint specifications
- To track software version changes
Correct answer: To visualize how data moves through a system, identifying trust boundaries and sensitive data flows
DFDs show how data flows between processes, data stores, and external entities, making trust boundaries visible and helping identify where security controls are needed.
Question 5: Which approach to security requirements gathers input from stakeholders to identify what the system must NOT do to prevent harm?
- Use case analysis
- Misuse case analysis (Correct answer)
- Functional decomposition
- Formal verification
Correct answer: Misuse case analysis
Misuse case analysis explicitly models malicious or unintended uses of the system to derive security requirements that prevent those scenarios.
Question 6: Which US regulation protects the privacy of student education records and limits disclosure of personally identifiable information?
- COPPA
- FERPA (Correct answer)
- HIPAA
- GLBA
Correct answer: FERPA
The Family Educational Rights and Privacy Act (FERPA) protects the privacy of student education records at schools receiving federal funding.
CSLLP Secure Software Requirements 2
What is the purpose of requirements traceability in secure software development?