CSSLP Secure Software Requirements Quiz

1. What does 'defense in depth' mean in the context of security requirements?

Multiple layers of security controls to protect against various attack vectors

A single strong authentication mechanism

Encryption of all data at rest

Frequent security audits

2. In secure requirements, what does 'fail securely' mean?

When a system fails, it defaults to a secure state and denies access

All failures must be documented in logs

The system should provide maximum functionality during failures

Failures should be hidden from users

3. What is the primary purpose of security traceability in requirements?

To map security requirements to design, implementation, and test cases

To increase project documentation volume

To eliminate functional requirements

To delay software release

4. Which technique helps identify security requirements by examining potential misuse scenarios?

Abuse case analysis

Unit testing

Code review

Performance profiling

5. True or False: Security requirements should be addressed only after all functional requirements are finalized.

True

False

6. What is the relationship between use cases and security requirements?

Security requirements define how to protect normal use cases and prevent abuse

They are completely unrelated

Security requirements replace use cases

Use cases eliminate the need for security requirements

7. Which of the following is NOT typically a secure software requirement?

The software must display colorful graphics

All user input must be validated

Sensitive data must be encrypted

Access controls must enforce authentication

8. What is the primary benefit of conducting a data flow analysis during requirements?

To identify where sensitive data flows and potential exposure points

To determine software pricing

To design the user interface

To schedule team meetings

9. True or False: Security requirements are static and do not change throughout the software lifecycle.

True

False

10. Which principle should guide the development of security requirements?

Least privilege—users have only minimum necessary permissions

Maximum functionality for all users

Simplicity over security

Avoiding encryption to improve performance

11. What is the primary purpose of conducting a threat model during the requirements phase?

To identify potential security threats and vulnerabilities before design

To document all compliance regulations

To test the final software product

To allocate budget for development

12. Which stakeholder should be involved in defining security requirements?

Security architects, developers, product managers, and compliance officers

Marketing team only

Executive leadership exclusively

Quality assurance testers only

13. True or False: Security requirements must be measurable and testable.

True

False

14. What is the purpose of establishing a security baseline in requirements?

To define minimum acceptable security controls and standards

To reduce the number of features

To accelerate deployment timelines

To eliminate user authentication

15. In secure requirements analysis, what is the primary goal of risk assessment?

To identify, analyze, and prioritize security risks to the application

To eliminate all possible software defects

To increase software development costs

To replace functional requirements

16. Which compliance framework is most relevant for software handling payment card data?

PCI DSS

HIPAA

GDPR

SOC 2

17. True or False: Security requirements should only be addressed during the testing phase.

True

False

18. What does STRIDE stand for in threat modeling?

Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege

Security, Testing, Requirements, Integration, Design, Execution

Software, Threat, Risk, Integration, Development, Engineering

Specification, Timing, Resilience, Infrastructure, Deployment, Evaluation

19. Security requirements should be derived from which of the following?

Threat analysis, risk assessment, and business objectives

Developer preferences only

Regulatory compliance documents alone

Historical software projects

20. Which of the following is a key component of secure software requirements?

Authentication and authorization controls

Marketing strategy

User interface design preferences

Hardware specifications

CSSLP Secure Software Requirements Quiz

1. What does 'defense in depth' mean in the context of security requirements?

2.

What first name or nickname would you like us to use?

2. In secure requirements, what does 'fail securely' mean?

3. What is the primary purpose of security traceability in requirements?

4. Which technique helps identify security requirements by examining potential misuse scenarios?

5. True or False: Security requirements should be addressed only after all functional requirements are finalized.

6. What is the relationship between use cases and security requirements?

7. Which of the following is NOT typically a secure software requirement?

8. What is the primary benefit of conducting a data flow analysis during requirements?

9. True or False: Security requirements are static and do not change throughout the software lifecycle.

10. Which principle should guide the development of security requirements?

11. What is the primary purpose of conducting a threat model during the requirements phase?

12. Which stakeholder should be involved in defining security requirements?

13. True or False: Security requirements must be measurable and testable.

14. What is the purpose of establishing a security baseline in requirements?

15. In secure requirements analysis, what is the primary goal of risk assessment?

16. Which compliance framework is most relevant for software handling payment card data?

17. True or False: Security requirements should only be addressed during the testing phase.

18. What does STRIDE stand for in threat modeling?

19. Security requirements should be derived from which of the following?

20. Which of the following is a key component of secure software requirements?