Which security control is the customer expected to implement when using an IaaS cloud service?

Managing the network switches and routers in the cloud provider's data center

Physical access controls to the data center

Patching the guest operating system of the virtual machines

Securing the hypervisor that hosts the virtual machines

Why is firmware security considered a critical component of the overall security architecture of a device?

Because firmware operates with high privileges and can control hardware, making it a prime target for persistent attacks.

Because firmware is the only layer that can enforce access control policies for applications.

Because firmware is the only component that stores encryption keys for user data.

Because firmware is typically written in high-level languages that are more prone to buffer overflows.

When designing an augmented reality application, which of the following is a primary reason to protect the camera feed and sensor data used for environment tracking?

To comply with app store guidelines for camera usage

To reduce the app's battery consumption during extended use

To prevent attackers from learning the user's physical location and surroundings

To improve the accuracy of object recognition in low-light conditions

A company's web application has a file upload feature that allows users to upload images. The application stores the files in a directory on the web server and serves them directly. An attacker discovers that they can upload a file with a .php extension, and the web server executes it as PHP code, leading to remote code execution (RCE). Which of the following is the most effective mitigation?

Disable PHP execution in the upload directory using a .htaccess file.

Rename the uploaded file to a random name with a .txt extension.

Scan the uploaded file with an antivirus program before storing it.

Store uploaded files outside the web root and serve them through a separate handler that enforces a strict allowlist of file types and sets the Content-Disposition header.

What is a common security pattern used in microservices architecture to manage external access?

Monolithic authentication module

Direct database access from each microservice

Shared secret hardcoded in all services

Certified Secure Software Lifecycle Professional

Domain 4Objective 1

Define the Security Architecture CSSLP Practice Questions (Page 1)

Part of the Secure Software Architecture and Design domain, which accounts for 15% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 2–3 from this objective — we provide 117 practice questions to prepare you well beyond it. (estimate)

117questions here

24free pages

43concepts

15%of the exam

43 Concepts in This Objective

SABSA framework
Security chain of responsibility
Federated identity
Security controls identification
Security controls prioritization
Client-server architecture
Peer-to-peer (P2P) architecture
Message queuing architecture
N-tier architecture
Service-oriented architecture (SOA)
Enterprise service bus (ESB)
Web services security
Microservices security
Client-side exploits and threats
Remote code execution risks
Constant connectivity implications
IoT security fundamentals
Wireless security
Location-based services security
RFID security
NFC security
Sensor networks security
Mesh network security
Secure boot
Secure memory
Secure update
SaaS security
PaaS security
IaaS security
Implicit data collection privacy
Side-channel mitigation
Speculative execution mitigation
Secure element
Firmware security
Driver security
AI security
Virtual reality security
Augmented reality security
Facility-related IoT security
Automotive IoT security
Robotics security
Medical device security
Software-defined production processes

Questions 1–5

1foundation · easy
Which security control is the customer expected to implement when using an IaaS cloud service?
Select an answer first
2foundation · easy
Why is firmware security considered a critical component of the overall security architecture of a device?
Select an answer first
3foundation · easy
When designing an augmented reality application, which of the following is a primary reason to protect the camera feed and sensor data used for environment tracking?
Select an answer first
4expert · hard
A company's web application has a file upload feature that allows users to upload images. The application stores the files in a directory on the web server and serves them directly. An attacker discovers that they can upload a file with a .php extension, and the web server executes it as PHP code, leading to remote code execution (RCE). Which of the following is the most effective mitigation?
Select an answer first
5foundation · easy
What is a common security pattern used in microservices architecture to manage external access?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.