What is the primary purpose of the security chain of responsibility in an organization?

To centralize all security decisions in a single security team

To ensure that only the CISO is accountable for security breaches

To eliminate the need for individual employees to consider security

To assign clear security roles and accountability across all levels of the organization

An e-commerce company uses a message queuing architecture to process orders. The order service places a message on a queue, and the fulfillment service consumes it. The security team is concerned about an attacker injecting fake order messages into the queue, and also about a malicious consumer reading order details. Which set of controls should be implemented to protect the message queue?

Use a simple API key in the message header for authentication.

Rely on the queue's network segmentation to prevent external access.

Use TLS for transport encryption and authenticate both producers and consumers with client certificates.

Encrypt the messages with a shared symmetric key known to all services.

In an augmented reality (AR) application, which security concern is most directly introduced by the AR layer itself, rather than by the underlying mobile or cloud platform?

SQL injection in the backend database that stores user profiles

Denial of service caused by excessive network requests to the cloud backend

Unauthorized access to the device's contact list through a permissions request

Manipulation of the rendered virtual objects to mislead the user's perception of the physical environment

What is a key security concern related to data exposure in constantly connected rich internet applications?

Data is less likely to be intercepted because of constant connection

Data encryption becomes unnecessary

Sensitive data may be transmitted more frequently and over multiple channels

Data is stored only on the client device

In a robotic system, what is the primary purpose of a safety-rated soft axis and space limiting function?

To reduce the robot's energy consumption during idle periods

To improve the accuracy of the robot's path planning

To restrict the robot's motion to a defined safe area

To encrypt communication between the robot and the controller

Certified Secure Software Lifecycle Professional

Domain 4Objective 1

Define the Security Architecture CSSLP Practice Questions (Page 18)

Part of the Secure Software Architecture and Design domain, which accounts for 15% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 2–3 from this objective — we provide 117 practice questions to prepare you well beyond it. (estimate)

117questions here

24free pages

43concepts

15%of the exam

43 Concepts in This Objective

SABSA framework
Security chain of responsibility
Federated identity
Security controls identification
Security controls prioritization
Client-server architecture
Peer-to-peer (P2P) architecture
Message queuing architecture
N-tier architecture
Service-oriented architecture (SOA)
Enterprise service bus (ESB)
Web services security
Microservices security
Client-side exploits and threats
Remote code execution risks
Constant connectivity implications
IoT security fundamentals
Wireless security
Location-based services security
RFID security
NFC security
Sensor networks security
Mesh network security
Secure boot
Secure memory
Secure update
SaaS security
PaaS security
IaaS security
Implicit data collection privacy
Side-channel mitigation
Speculative execution mitigation
Secure element
Firmware security
Driver security
AI security
Virtual reality security
Augmented reality security
Facility-related IoT security
Automotive IoT security
Robotics security
Medical device security
Software-defined production processes

Questions 86–90

86foundation · easy
What is the primary purpose of the security chain of responsibility in an organization?
Select an answer first
87application · medium
An e-commerce company uses a message queuing architecture to process orders. The order service places a message on a queue, and the fulfillment service consumes it. The security team is concerned about an attacker injecting fake order messages into the queue, and also about a malicious consumer reading order details. Which set of controls should be implemented to protect the message queue?
Select an answer first
88foundation · easy
In an augmented reality (AR) application, which security concern is most directly introduced by the AR layer itself, rather than by the underlying mobile or cloud platform?
Select an answer first
89foundation · easy
What is a key security concern related to data exposure in constantly connected rich internet applications?
Select an answer first
90foundation · easy
In a robotic system, what is the primary purpose of a safety-rated soft axis and space limiting function?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.