CSSLP Domain 2 – Secure Software Requirements

Question 1

1. What are the two main types of software requirements?

Answer 1

Functional requirements (what the system must do) and Non-functional requirements (how the system performs).

Question 2

2. What is the purpose of defining security requirements early in the SDLC?

Answer 2

To ensure security is designed into the system rather than added later, reducing rework and vulnerabilities.

Question 3

3. What is the difference between compliance and conformance?

Answer 3

Compliance refers to meeting external legal or regulatory requirements; conformance relates to internal policies and standards.

Question 4

4. What are examples of external compliance requirements in software development?

Answer 4

Laws and regulations such as GDPR, HIPAA, PCI DSS, SOX, and FISMA.

Question 5

5. What does FISMA require of U.S. federal agencies?

Answer 5

Implementation of an organization-wide information security program, including risk categorization and control assessment.

Question 6

6. What does SOX (Sarbanes-Oxley Act) ensure in the context of software systems?

Answer 6

Integrity and control over financial data within accounting and reporting systems.

Question 7

7. What are the three rules under the Gramm-Leach-Bliley Act (GLBA)?

Answer 7

Financial Privacy Rule, Safeguards Rule, and Pretexting Protection Rule.

Question 8

8. What is the primary goal of HIPAA and HITECH?

Answer 8

To protect personal health information (PHI) and enhance privacy of electronic health records.

Question 9

9. What is the main objective of the PCI DSS standard?

Answer 9

To protect cardholder data and ensure secure payment processing across merchants and service providers.

Question 10

10. Define PII and PHI.

Answer 10

PII (Personally Identifiable Information) identifies an individual; PHI (Protected Health Information) relates to medical data linked to an individual.

Question 11

11. What is a Misuse Case?

Answer 11

A scenario describing how a system can be intentionally or unintentionally used in a way that causes harm or violates policy.

Question 12

12. How are Misuse Cases different from Use Cases?

Answer 12

Use cases describe expected behavior; misuse cases describe undesired or malicious behavior.

Question 13

13. What is the role of a Security Requirements Traceability Matrix (SRTM)?

Answer 13

To link each security requirement to its implementation and test cases, ensuring coverage and verification.

Question 14

14. What is the importance of Data Classification?

Answer 14

It determines how data should be handled, stored, and protected based on its sensitivity and impact if compromised.

Question 15

15. What are typical data classification categories?

Answer 15

Public, Internal, Confidential, and Restricted (or variations depending on the organization).

Question 16

16. What are the key elements of a data lifecycle?

Answer 16

Creation, Storage, Use, Sharing, Archival, and Destruction/Disposition.

Question 17

17. What is the ‘Right to be Forgotten’?

Answer 17

A privacy principle under GDPR allowing individuals to request deletion of their personal data.

Question 18

18. What are privacy-by-design principles?

Answer 18

Embedding privacy considerations (minimization, consent, transparency) into system design from the start.

Question 19

19. What is the primary purpose of conducting a Privacy Impact Assessment (PIA)?

Answer 19

To evaluate and document privacy risks associated with a system or project before deployment.

Question 20

20. What is the difference between data anonymization and pseudonymization?

Answer 20

Anonymization removes identifiers irreversibly; pseudonymization replaces them with reversible tokens or keys.

Question 21

21. What are the three data processing conditions under GDPR?

Answer 21

Transparency (informed consent), Legitimate purpose (data use tied to a lawful purpose), and Proportionality (data use limited to what’s needed).

Question 22

22. What is the relationship between threat modeling and requirements?

Answer 22

Threat modeling identifies potential risks that translate into security requirements and countermeasures.

Question 23

23. How can developers ensure third-party suppliers meet security requirements?

Answer 23

Include explicit security clauses and right-to-audit provisions in contracts and perform supplier assessments.

Question 24

24. What are non-functional security requirements examples?

Answer 24

Availability targets, encryption strength, authentication response times, and audit log retention.

Question 25

25. What should be considered when defining retention policies for data?

Answer 25

Business need, legal hold requirements, privacy obligations, and secure disposal procedures.

Question 26

Question

Answer 26

Model Answer

Question 27

Explain why early identification of security requirements is crucial. (Domain 2)

Answer 27

Early identification reduces rework, ensures alignment with business goals, and prevents security gaps later in the SDLC.

Question 28

Describe the role of misuse and abuse cases in defining requirements. (Domain 2)

Answer 28

They help identify potential security threats and ensure controls are designed to prevent or detect them.

Question 29

Define traceability in the context of security requirements. (Domain 2)

Answer 29

Traceability ensures each requirement can be mapped to design, implementation, and testing for full coverage.

Question 30

Explain how stakeholder input influences security requirements. (Domain 2)

Answer 30

Stakeholders clarify risk tolerance, regulatory obligations, and operational constraints influencing security controls.

Question 31

Describe how regulatory obligations impact security requirements. (Domain 2)

Answer 31

Regulations impose minimum control expectations that must be translated into software behaviors and safeguards.

Question 32

Explain the concept of requirement validation. (Domain 2)

Answer 32

Validation ensures requirements accurately reflect stakeholder needs and intended system functionality.

Question 33

Define the term 'derived security requirement.' (Domain 2)

Answer 33

A requirement inferred from a higher-level objective or constraint, ensuring detailed implementation of controls.

Question 34

Describe how risk assessment drives requirement prioritization. (Domain 2)

Answer 34

Higher-risk areas receive more stringent or earlier security requirements to reduce exposure.

Question 35

Explain the difference between requirement verification and validation. (Domain 2)

Answer 35

Verification checks correctness and completeness; validation ensures alignment with stakeholder intent.

Question 36

Describe the purpose of security requirement workshops. (Domain 2)

Answer 36

Workshops bring together cross-functional experts to elicit, refine, and approve security needs collaboratively.

Question 37

Explain how requirement ambiguity can lead to vulnerabilities. (Domain 2)

Answer 37

Unclear or conflicting requirements can lead to inconsistent implementation and exploitable weaknesses.

Question 38

Define a non-functional security requirement and provide an example. (Domain 2)

Answer 38

A performance-related control, e.g., 'The system must log all failed authentication attempts within one second.'

Question 39

Describe the purpose of requirements baselining. (Domain 2)

Answer 39

It establishes an approved version of requirements for controlled change and consistency.

Question 40

Explain the role of threat modeling in refining requirements. (Domain 2)

Answer 40

Threat modeling exposes risks that can be mitigated through additional or stronger security requirements.

Question 41

Define what is meant by 'testable requirement.' (Domain 2)

Answer 41

A requirement that can be objectively verified through inspection, demonstration, or testing.

Question 42

Describe the relationship between functional and security requirements. (Domain 2)

Answer 42

Functional requirements define intended behavior; security requirements ensure that behavior is protected and constrained.

Question 43

Explain how to manage conflicting security and usability requirements. (Domain 2)

Answer 43

Balance both by using risk-based trade-offs and user-centered security design principles.

Question 44

Define acceptance criteria for security requirements. (Domain 2)

Answer 44

Measurable conditions that confirm when a requirement has been successfully implemented and verified.

Question 45

Explain why version control of requirements is necessary. (Domain 2)

Answer 45

It ensures traceability, prevents miscommunication, and enables rollback to earlier baselines when needed.

Question 46

Describe how to ensure third-party compliance within security requirements. (Domain 2)

Answer 46

Include contractual clauses, SLAs, and audits aligned with organizational security expectations.

Question 47

Explain the value of prototyping in refining security requirements. (Domain 2)

Answer 47

Prototyping reveals design flaws early and allows stakeholders to validate usability and security expectations.

Question 48

Define 'requirement coverage' and why it matters. (Domain 2)

Answer 48

It ensures that all identified risks and objectives have corresponding requirements and controls.

Question 49

Describe the impact of agile methodologies on managing security requirements. (Domain 2)

Answer 49

Agile integrates security into user stories, acceptance criteria, and sprint reviews for continuous assurance.

Question 50

Explain how reusability of security requirements improves efficiency. (Domain 2)

Answer 50

Reusable requirements and templates streamline future projects and ensure consistency across systems.

Question 51

Define the concept of 'security requirement debt.' (Domain 2)

Answer 51

It represents postponed or incomplete security requirements that increase risk until addressed.

Question 52

Question

Answer 52

Model Answer

Question 53

Explain the importance of integrating security requirements into the SDLC. (Domain 2)

Answer 53

Integrating security early ensures that risks are identified and addressed before costly design or implementation changes are required.

Question 54

Describe the relationship between business requirements and security requirements. (Domain 2)

Answer 54

Security requirements must support business objectives by protecting critical assets while enabling functionality.

Question 55

Define functional and non-functional security requirements. (Domain 2)

Answer 55

Functional requirements define specific security features; non-functional requirements specify qualities like performance, reliability, and confidentiality.

Question 56

Explain how system misuse can help define security requirements. (Domain 2)

Answer 56

Analyzing potential misuse scenarios helps identify needed preventive, detective, and corrective controls.

Question 57

Describe how regulatory requirements influence security requirements. (Domain 2)

Answer 57

Regulations define minimum controls that must be incorporated into system specifications to ensure compliance.

Question 58

Define requirements elicitation and its relevance to security. (Domain 2)

Answer 58

Elicitation gathers stakeholder input, threat intelligence, and regulatory needs to define security expectations clearly.

Question 59

Explain how stakeholder engagement impacts security requirement completeness. (Domain 2)

Answer 59

Early collaboration ensures all perspectives—business, technical, and compliance—are reflected in requirements.

Question 60

Describe the role of workshops in refining security requirements. (Domain 2)

Answer 60

Workshops provide structured collaboration to clarify ambiguous requirements and prioritize risks.

Question 61

Explain how conflicting requirements are managed. (Domain 2)

Answer 61

Conflicts are resolved by assessing business priorities, risks, and technical feasibility through stakeholder consensus.

Question 62

Define traceability and explain why it is important for requirements management. (Domain 2)

Answer 62

Traceability ensures that each requirement can be linked to design, implementation, and testing artifacts for completeness and accountability.

Question 63

Identify characteristics of a well-written security requirement. (Domain 2)

Answer 63

It should be clear, measurable, feasible, consistent, and testable.

Question 64

Explain the difference between requirement validation and verification. (Domain 2)

Answer 64

Validation ensures requirements meet stakeholder intent; verification ensures they are implemented correctly.

Question 65

Describe how ambiguity in requirements can introduce vulnerabilities. (Domain 2)

Answer 65

Unclear wording may lead to inconsistent implementation and exploitable weaknesses.

Question 66

Define the term 'testable requirement.' (Domain 2)

Answer 66

A requirement that can be objectively measured or confirmed through inspection or testing.

Question 67

Explain how acceptance criteria ensure requirement quality. (Domain 2)

Answer 67

Acceptance criteria define measurable outcomes that confirm a requirement is satisfied.

Question 68

Describe how threat modeling contributes to requirements definition. (Domain 2)

Answer 68

It identifies attack vectors and system weaknesses that must be mitigated through specific requirements.

Question 69

Explain the relationship between risk assessment and security requirements. (Domain 2)

Answer 69

Risk assessment determines which controls are necessary and how they should be prioritized.

Question 70

Define risk tolerance and its role in security requirements. (Domain 2)

Answer 70

Risk tolerance defines acceptable levels of risk, guiding the strictness of security controls.

Question 71

Explain why continuous risk assessment is important. (Domain 2)

Answer 71

New threats and system changes require ongoing evaluation of whether requirements remain adequate.

Question 72

Describe how mitigation strategies affect requirement scope. (Domain 2)

Answer 72

Each risk treatment—accept, avoid, transfer, mitigate—defines or modifies related security requirements.

Question 73

Explain how data classification impacts security requirements. (Domain 2)

Answer 73

Data classification determines protection levels such as encryption, access control, and retention.

Question 74

Describe privacy requirements related to personal data. (Domain 2)

Answer 74

Requirements should enforce consent management, purpose limitation, and data minimization principles.

Question 75

Define data retention requirements. (Domain 2)

Answer 75

They specify how long data is stored, the conditions for deletion, and methods for secure disposal.

Question 76

Explain how anonymization and pseudonymization affect requirements. (Domain 2)

Answer 76

They require secure methods to de-identify or protect personal information without losing utility.

Question 77

Describe how access control requirements support privacy. (Domain 2)

Answer 77

Access controls ensure only authorized users can view or modify sensitive data, protecting confidentiality.

Question 78

Define requirements baselining. (Domain 2)

Answer 78

Baselining establishes an approved set of requirements against which changes are managed.

Question 79

Explain the purpose of change control for requirements. (Domain 2)

Answer 79

It ensures modifications are reviewed and approved to maintain consistency and traceability.

Question 80

Describe the importance of version control for requirements documentation. (Domain 2)

Answer 80

Version control maintains history, supports audits, and prevents loss of earlier approved content.

Question 81

Explain why maintaining requirement history supports audits. (Domain 2)

Answer 81

It provides evidence that decisions were made methodically and in alignment with security policy.

Question 82

Define requirement reuse and its advantages. (Domain 2)

Answer 82

Reusable requirements promote consistency, efficiency, and reliability across projects.

Question 83

Describe how Agile development affects security requirements management. (Domain 2)

Answer 83

Security requirements must be incorporated into user stories, acceptance criteria, and sprint reviews for ongoing assurance.

Question 84

Explain the role of security champions in Agile teams. (Domain 2)

Answer 84

They advocate security practices and ensure that user stories include appropriate security acceptance criteria.

Question 85

Describe how backlog refinement supports security requirements. (Domain 2)

Answer 85

It ensures that security tasks are visible, prioritized, and scoped appropriately for upcoming sprints.

Question 86

Explain how 'definition of done' supports secure delivery. (Domain 2)

Answer 86

Including security checks in the definition of done ensures vulnerabilities are addressed before release.

Question 87

Describe continuous feedback loops for security requirements. (Domain 2)

Answer 87

Feedback from testing, incidents, and reviews updates and strengthens future requirements.

Question 88

Explain the concept of requirements verification in security testing. (Domain 2)

Answer 88

Verification confirms that each requirement is implemented as specified and functions securely.

Question 89

Describe the role of audits in validating requirements compliance. (Domain 2)

Answer 89

Audits verify that requirements are met and provide independent assurance of compliance.

Question 90

Explain how automated tools support requirements traceability. (Domain 2)

Answer 90

Tools link requirements to design and testing artifacts, simplifying validation and change tracking.

Question 91

Define the term 'security control objective' and how it relates to requirements. (Domain 2)

Answer 91

A control objective outlines the intent behind a control, guiding the formulation of detailed security requirements.

Question 92

Describe the benefit of maintaining a requirements repository. (Domain 2)

Answer 92

A repository enables reuse, version control, and quick access to approved security requirement templates.

Question 93

Explain how lessons learned from incidents influence new requirements. (Domain 2)

Answer 93

Post-incident analysis often reveals gaps or weaknesses that must be formalized as updated requirements.

Question 94

Describe how metrics can be used to evaluate requirement effectiveness. (Domain 2)

Answer 94

Metrics like defect density and time-to-fix measure how well requirements mitigate real risks.

Question 95

Explain why continuous improvement is essential for requirements engineering. (Domain 2)

Answer 95

As threats and technologies evolve, security requirements must adapt to maintain relevance and effectiveness.

Question 96

Describe how requirements maturity models support continuous improvement. (Domain 2)

Answer 96

They provide a structured path for improving how requirements are developed, maintained, and verified.

Question 97

Define the concept of measurable security outcomes in requirements. (Domain 2)

Answer 97

Outcomes specify what successful protection looks like, ensuring focus on results rather than only activities.