CSLLP Secure Software Requirements 1 — Questions and Answers
Question 1: What type of software requirement defines how the system should behave in terms of security, performance, or reliability?
- Functional requirement
- Non-functional requirement (Correct answer)
- Business requirement
- User story
Correct answer: Non-functional requirement
Non-functional requirements describe system qualities such as security, performance, and maintainability rather than specific behaviors or functions.
Question 2: Which process involves identifying and classifying data based on its sensitivity to determine appropriate security controls?
- Data normalization
- Data classification (Correct answer)
- Data aggregation
- Data masking
Correct answer: Data classification
Data classification assigns labels (such as public, internal, confidential, or top secret) to data based on sensitivity, guiding decisions about protection mechanisms.
Question 3: In abuse case modeling, what does an abuse case represent?
- A use case that has not been tested
- A scenario describing how an attacker might misuse the system (Correct answer)
- A poorly written user story
- A deprecated software feature
Correct answer: A scenario describing how an attacker might misuse the system
Abuse cases (also called misuse cases) describe how a malicious actor or a user with bad intent could abuse the system's functionality to cause harm.
Question 4: What is a security requirement that specifies users must be authenticated before accessing any resource?
- Authorization requirement
- Authentication requirement (Correct answer)
- Audit requirement
- Availability requirement
Correct answer: Authentication requirement
An authentication requirement specifies how and when users must prove their identity before the system grants them access to resources.
Question 5: Which US law mandates security and privacy requirements for federal agency information systems?
- HIPAA
- PCI DSS
- FISMA (Correct answer)
- GLBA
Correct answer: FISMA
The Federal Information Security Modernization Act (FISMA) requires federal agencies to develop, document, and implement security programs for their information systems.
Question 6: Which standard provides a framework for software assurance maturity, helping organizations improve their secure software development practices?
- ISO 27001
- OWASP SAMM (Correct answer)
- NIST CSF
- CIS Benchmarks
Correct answer: OWASP SAMM
The OWASP Software Assurance Maturity Model (SAMM) provides a measurable framework for integrating security practices into software development and helps organizations benchmark their maturity.
CSLLP Secure Software Requirements 1
What type of software requirement defines how the system should behave in terms of security, performance, or reliability?