Challenge Your Exam Readiness With Our Free CAPM Practice Questions

Option B is specific, measurable, and testable. It defines traceability (who changed what, when), retention period, tamper-evidence, and access control aligned to role-based policies. Such clarity guides architecture (audit logging, WORM storage, key management), verification (log integrity checks, access tests), and operations (retention jobs, monitoring). “Use secure coding” (A) and “encrypt everything” (C) are vague and can’t be verified without concrete thresholds and scope. “Periodic reviews” (D) is a process requirement, not a product quality attribute. CAPM’s business analysis content stresses expressing NFRs as objective criteria tied to compliance (e.g., GDPR, HIPAA), with traceability to tests and controls. Early articulation reduces costly rework and supports vendor/tool evaluation. Include measurement methods and environments, and ensure the NFRs are reflected in the Definition of Done so that security is built-in rather than bolted on late in the cycle.