CSSLP Practice Questions: Secure Software Requirements Domain

Correct Answer: A

Explanation: Running automated security tests as part of the build process is a core practice of DevSecOps. It ensures that security checks are performed continuously and integrated into the CI/CD pipeline, allowing for early detection and remediation of vulnerabilities.

Correct Answer: A

Explanation: Including security requirements in the initial project scope document ensures that they are considered from the beginning of the project, aligning with the goal of integrating security early in the SDLC. Option B, performing a security audit after development, is too late to influence the design. Option C, relying on developers, is not a structured approach to ensuring compliance. Option D, scheduling a penetration test before deployment, is important but should not replace early integration of security requirements.

Correct Answer: C

Explanation: Model-driven requirements engineering with formal verification is essential for this complex scenario. It provides mathematical models to represent requirements, automated conflict detection between contradictory regulations, formal verification of security properties, and systematic resolution of regulatory conflicts. The complexity of multiple jurisdictions, performance constraints, and advanced cryptographic requirements necessitates formal methods to ensure consistency and completeness while managing regulatory conflicts systematically.

Correct Answer: B

Explanation: The BEST initial step is to review applicable regulatory and compliance requirements (Option B) to ensure that the application will meet necessary legal and industry standards. This aligns with the Identify phase of the secure SDLC. Option A (threat modeling) is important but typically follows the identification of compliance requirements. Option C (security code review) and Option D (security test plan) are premature at this stage as they pertain to later phases in the SDLC.

Correct Answer: B

Explanation: Reviewing relevant regulatory compliance standards and mapping them to security requirements is the most strategic next step. This ensures that the application's security requirements are comprehensive and aligned with compliance needs from the beginning. While threat modeling (A) and secure coding guidelines (C) are important, they should follow the establishment of security requirements. Security training (D) is also important but not the immediate priority in the requirements gathering phase.