A healthcare provider wants to allow its patients to use their existing Google or Facebook credentials to log in to the patient portal, while still maintaining a central record of the patient's identity and attributes within the provider's own systems. The solution must support single sign-on (SSO) across the portal and a future mobile app, and it must not require the provider to store user passwords. Which architecture should the security architect recommend?

Deploy a VPN that allows patients to access the portal through a secure tunnel, bypassing the need for authentication.

Implement federated identity using SAML 2.0 or OpenID Connect, with the provider as the relying party and Google/Facebook as identity providers.

Use a reverse proxy that forwards the user's Google or Facebook session cookie to the patient portal for authentication.

Create a local user database and synchronize passwords from Google and Facebook using a nightly batch job.

Which of the following is a primary security concern that is specific to SaaS applications and must be addressed by the customer?

Configuring identity and access management for their users

Managing the underlying hypervisor's patch level

Applying security updates to the application's source code

Hardening the guest operating system of the virtual machines running the application

Which of the following is an example of implicit data collection?

A user selects their preferred language from a dropdown menu.

A mobile app records the device's GPS coordinates when the user opens the app.

A user enters their date of birth in a profile setup wizard.

A user answers a survey question about their shopping habits.

Which of the following is a primary security advantage of using a PaaS offering over a traditional on-premises application platform?

The provider manages patching of the underlying runtime and middleware

The provider automatically encrypts all application data at rest and in transit

The customer gains full control over the host operating system

The customer is relieved of all application-level security responsibilities

Which of the following is a security architecture consideration specific to virtual reality (VR) applications?

Protecting the confidentiality and integrity of the user's real-world environment data captured by sensors

Implementing strong password policies for user accounts

Ensuring the VR headset's firmware is regularly updated to patch vulnerabilities

Using a content delivery network (CDN) to distribute VR application files

Certified Secure Software Lifecycle Professional

Domain 4Objective 1

Define the Security Architecture CSSLP Practice Questions (Page 15)

Part of the Secure Software Architecture and Design domain, which accounts for 15% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 2–3 from this objective — we provide 117 practice questions to prepare you well beyond it. (estimate)

117questions here

24free pages

43concepts

15%of the exam

43 Concepts in This Objective

SABSA framework
Security chain of responsibility
Federated identity
Security controls identification
Security controls prioritization
Client-server architecture
Peer-to-peer (P2P) architecture
Message queuing architecture
N-tier architecture
Service-oriented architecture (SOA)
Enterprise service bus (ESB)
Web services security
Microservices security
Client-side exploits and threats
Remote code execution risks
Constant connectivity implications
IoT security fundamentals
Wireless security
Location-based services security
RFID security
NFC security
Sensor networks security
Mesh network security
Secure boot
Secure memory
Secure update
SaaS security
PaaS security
IaaS security
Implicit data collection privacy
Side-channel mitigation
Speculative execution mitigation
Secure element
Firmware security
Driver security
AI security
Virtual reality security
Augmented reality security
Facility-related IoT security
Automotive IoT security
Robotics security
Medical device security
Software-defined production processes

Questions 71–75

71application · medium
A healthcare provider wants to allow its patients to use their existing Google or Facebook credentials to log in to the patient portal, while still maintaining a central record of the patient's identity and attributes within the provider's own systems. The solution must support single sign-on (SSO) across the portal and a future mobile app, and it must not require the provider to store user passwords. Which architecture should the security architect recommend?
Select an answer first
72foundation · easy
Which of the following is a primary security concern that is specific to SaaS applications and must be addressed by the customer?
Select an answer first
73foundation · easy
Which of the following is an example of implicit data collection?
Select an answer first
74foundation · easy
Which of the following is a primary security advantage of using a PaaS offering over a traditional on-premises application platform?
Select an answer first
75foundation · easy
Which of the following is a security architecture consideration specific to virtual reality (VR) applications?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.