CSLLP Secure Software Requirements 3

Question 1

Which security requirement category ensures that data is protected from unauthorized access when stored on disk?

Accepted Answer

Data at rest protection

Answer

Data at rest protection requirements specify controls such as disk encryption, access controls, and key management to protect stored data from unauthorized access.

Question 2

A requirement that specifies the system must record all access attempts to sensitive data is an example of:

Accepted Answer

Audit and accountability requirement

Answer

Audit and accountability requirements ensure that actions can be traced to responsible individuals, supporting incident response, forensics, and compliance activities.

Question 3

What is the primary purpose of a privacy policy in software development?

Accepted Answer

To describe how an organization collects, uses, and protects personal information

Answer

A privacy policy is a public statement that discloses how an organization gathers, uses, manages, and protects user personal data.

Question 4

Which term describes the process of breaking down complex security requirements into smaller, actionable components?

Accepted Answer

Requirements decomposition

Answer

Requirements decomposition breaks high-level security requirements into specific, testable, and implementable components that can be assigned to development teams.

Question 5

In secure software development, what is a 'security user story'?

Accepted Answer

An agile artifact describing a security requirement in terms of user roles, goals, and outcomes

Answer

Security user stories apply the agile user story format to security requirements, expressing them as 'As a [role], I need [security feature] so that [security outcome].'

CSLLP - Certified Secure Software Lifecycle Professional Practice Test

CSLLP - Certified Secure Software Lifecycle Professional Practice Test

CSLLP Secure Software Requirements 3