CAS-002 · Question #559
The Chief Executive Officer (CEO) has asked a security project manager to provide recommendations on the breakout of tasks for the development of a new product. The CEO thinks that by assigning…
The correct answer is B. Systems Engineering. Decomposing requirements. Assigning decomposing requirements to Systems Engineering reflects proper secure SDLC role separation, ensuring each team contributes within its domain of expertise.
Question
The Chief Executive Officer (CEO) has asked a security project manager to provide recommendations on the breakout of tasks for the development of a new product. The CEO thinks that by assigning areas of work appropriately the overall security of the product will be increased, because staff will focus on their areas of expertise. Given the below groups and tasks select the BEST list of assignments. Groups: Networks, Development, Project Management, Security, Systems Engineering, Testing Tasks: Decomposing requirements, Secure coding standards, Code stability, Functional validation, Stakeholder engagement, Secure transport
Options
- ASystems Engineering. Decomposing requirements
- BSystems Engineering. Decomposing requirements
- CSystems Engineering. Functional validation
- DSystems Engineering. Decomposing requirements
How the community answered
(29 responses)- A21% (6)
- B66% (19)
- C10% (3)
- D3% (1)
Why each option
Assigning decomposing requirements to Systems Engineering reflects proper secure SDLC role separation, ensuring each team contributes within its domain of expertise.
Although choice A shows the same Systems Engineering assignment as B, it represents an incorrect overall group-to-task mapping for the remaining teams, making it a less complete and accurate answer.
Systems Engineering is the correct owner of decomposing requirements because that team translates high-level stakeholder needs into precise technical specifications that feed other disciplines. This separation ensures the Security, Development, and Testing teams receive well-scoped inputs aligned with their functions. Correctly matched task assignments reduce requirement gaps and design ambiguities that could introduce security vulnerabilities.
Assigning functional validation to Systems Engineering misaligns roles - functional validation belongs to the Testing team, which is responsible for verifying that the product meets defined requirements.
Choice D also assigns decomposing requirements to Systems Engineering but pairs the other groups with tasks that do not best match their expertise, making the full assignment set inferior to option B.
Concept tested: Secure SDLC role assignment and task decomposition
Source: https://csrc.nist.gov/publications/detail/sp/800-64/rev-2/final
Topics
Community Discussion
No community discussion yet for this question.