nerdexam
CompTIA

CAS-002 · Question #559

The Chief Executive Officer (CEO) has asked a security project manager to provide recommendations on the breakout of tasks for the development of a new product. The CEO thinks that by assigning…

The correct answer is B. Systems Engineering. Decomposing requirements. Assigning decomposing requirements to Systems Engineering reflects proper secure SDLC role separation, ensuring each team contributes within its domain of expertise.

Integration of Computing, Communications and Business Disciplines

Question

The Chief Executive Officer (CEO) has asked a security project manager to provide recommendations on the breakout of tasks for the development of a new product. The CEO thinks that by assigning areas of work appropriately the overall security of the product will be increased, because staff will focus on their areas of expertise. Given the below groups and tasks select the BEST list of assignments. Groups: Networks, Development, Project Management, Security, Systems Engineering, Testing Tasks: Decomposing requirements, Secure coding standards, Code stability, Functional validation, Stakeholder engagement, Secure transport

Options

  • ASystems Engineering. Decomposing requirements
  • BSystems Engineering. Decomposing requirements
  • CSystems Engineering. Functional validation
  • DSystems Engineering. Decomposing requirements

How the community answered

(29 responses)
  • A
    21% (6)
  • B
    66% (19)
  • C
    10% (3)
  • D
    3% (1)

Why each option

Assigning decomposing requirements to Systems Engineering reflects proper secure SDLC role separation, ensuring each team contributes within its domain of expertise.

ASystems Engineering. Decomposing requirements

Although choice A shows the same Systems Engineering assignment as B, it represents an incorrect overall group-to-task mapping for the remaining teams, making it a less complete and accurate answer.

BSystems Engineering. Decomposing requirementsCorrect

Systems Engineering is the correct owner of decomposing requirements because that team translates high-level stakeholder needs into precise technical specifications that feed other disciplines. This separation ensures the Security, Development, and Testing teams receive well-scoped inputs aligned with their functions. Correctly matched task assignments reduce requirement gaps and design ambiguities that could introduce security vulnerabilities.

CSystems Engineering. Functional validation

Assigning functional validation to Systems Engineering misaligns roles - functional validation belongs to the Testing team, which is responsible for verifying that the product meets defined requirements.

DSystems Engineering. Decomposing requirements

Choice D also assigns decomposing requirements to Systems Engineering but pairs the other groups with tasks that do not best match their expertise, making the full assignment set inferior to option B.

Concept tested: Secure SDLC role assignment and task decomposition

Source: https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/final

Topics

#SDLC roles#separation of duties#secure development#task assignment

Community Discussion

No community discussion yet for this question.

Full CAS-002 Practice