CSLLP Secure Software Requirements 2

Question 1

What is the purpose of requirements traceability in secure software development?

Accepted Answer

To link security requirements to design decisions, code, and tests ensuring nothing is missed

Answer

Requirements traceability ensures every security requirement can be traced forward to its implementation and test cases, confirming all requirements are addressed.

Question 2

Which of the following best describes personally identifiable information (PII)?

Accepted Answer

Information that can be used to identify, contact, or locate a specific individual

Answer

PII is any information that can be used on its own or in combination with other information to identify, contact, or locate a single person.

Question 3

A system that processes payment card data must comply with which standard?

Accepted Answer

PCI DSS

Answer

The Payment Card Industry Data Security Standard (PCI DSS) is a set of security requirements for organizations that store, process, or transmit cardholder data.

Question 4

What is the purpose of a data flow diagram (DFD) in security requirements analysis?

Accepted Answer

To visualize how data moves through a system, identifying trust boundaries and sensitive data flows

Answer

DFDs show how data flows between processes, data stores, and external entities, making trust boundaries visible and helping identify where security controls are needed.

Question 5

Which approach to security requirements gathers input from stakeholders to identify what the system must NOT do to prevent harm?

Accepted Answer

Misuse case analysis

Answer

Misuse case analysis explicitly models malicious or unintended uses of the system to derive security requirements that prevent those scenarios.

CSLLP - Certified Secure Software Lifecycle Professional Practice Test

CSLLP - Certified Secure Software Lifecycle Professional Practice Test

CSLLP Secure Software Requirements 2