CAS-002 · Question #772
A security engineer is working on a large software development project. As part of the design of the project, various stakeholder requirements were gathered and decomposed to an implementable and…
The correct answer is B. Level 1: Requirements 1 and 4. An SRTM organizes requirements hierarchically from high-level functional goals down to specific, testable implementations. Requirements 1 and 4 are top-level because they state broad security objectives, while Requirements 2, 3, and 5 are derived child requirements specifying…
Question
A security engineer is working on a large software development project. As part of the design of the project, various stakeholder requirements were gathered and decomposed to an implementable and testable level. Various security requirements were also documented. Organize the following security requirements into the correct hierarchy required for an SRTM. Requirement 1: The system shall provide confidentiality for data in transit and data at rest. Requirement 2: The system shall use SSL, SSH, or SCP for all data transport. Requirement 3: The system shall implement a file-level encryption scheme. Requirement 4: The system shall provide integrity for all data at rest. Requirement 5: The system shall perform CRC checks on all files.
Options
- ALevel 1: Requirements 1 and 4;
- BLevel 1: Requirements 1 and 4;
- CLevel 1: Requirements 1 and 4;
- DLevel 1: Requirements 1, 2, and 3;
How the community answered
(61 responses)- A21% (13)
- B62% (38)
- C10% (6)
- D7% (4)
Why each option
An SRTM organizes requirements hierarchically from high-level functional goals down to specific, testable implementations. Requirements 1 and 4 are top-level because they state broad security objectives, while Requirements 2, 3, and 5 are derived child requirements specifying how those objectives are met.
Choice A incorrectly assigns the Level 2 derived requirements to the wrong parent requirements, breaking the traceability chain between high-level goals and their specific implementations.
In a Security Requirements Traceability Matrix, Level 1 requirements express broad, system-level security goals - Requirements 1 (confidentiality) and 4 (integrity) fulfill this role. Requirements 2 and 3 are derived from Requirement 1 (specifying how to achieve confidentiality in transit and at rest), and Requirement 5 is derived from Requirement 4 (specifying how integrity is verified), making them Level 2 children mapped to their respective parents.
Choice C incorrectly maps the implementation-specific requirements (2, 3, 5) to parent requirements they do not logically derive from, violating the SRTM traceability hierarchy.
Choice D incorrectly elevates Requirements 2 and 3 to Level 1 alongside Requirement 1, but these are implementation-specific mechanisms (SSL/SSH/SCP and file encryption) that are derived from and subordinate to the higher-level confidentiality objective.
Concept tested: Security Requirements Traceability Matrix hierarchy organization
Source: https://csrc.nist.gov/publications/detail/sp/800-160/vol-1/rev-1/final
Topics
Community Discussion
No community discussion yet for this question.