CSLLP Secure Software Requirements 3

Question 1

Which security requirement category ensures that data is protected from unauthorized access when stored on disk?

Accepted Answer

Data at rest protection

Answer

Data in transit protection

Answer

Data masking requirement

Answer

Audit logging requirement

Question 2

A requirement that specifies the system must record all access attempts to sensitive data is an example of:

Accepted Answer

Audit and accountability requirement

Answer

Authentication requirement

Answer

Authorization requirement

Answer

Availability requirement

Question 3

What is the primary purpose of a privacy policy in software development?

Accepted Answer

To describe how an organization collects, uses, and protects personal information

Answer

To specify encryption algorithms used by the application

Answer

To document internal access control policies

Answer

To define incident response procedures

Question 4

Which term describes the process of breaking down complex security requirements into smaller, actionable components?

Accepted Answer

Requirements decomposition

Answer

Risk decomposition

Answer

Threat modeling

Answer

Security partitioning

Question 5

In secure software development, what is a 'security user story'?

Accepted Answer

An agile artifact describing a security requirement in terms of user roles, goals, and outcomes

Answer

A use case written from a security analyst's perspective

Answer

A vulnerability report in story format

Answer

A pen tester's narrative of an attack scenario

Question 6

Which US law requires healthcare organizations to implement safeguards protecting the privacy and security of electronic protected health information (ePHI)?

Accepted Answer

HIPAA

Answer

FERPA

Answer

GLBA

Answer

SOX