A company is migrating from a monolithic application to a microservices architecture. The security architect must design a solution for service-to-service authentication and authorization. The company wants to avoid a central point of failure and ensure that each service can independently verify the identity of the calling service. Which approach best meets these requirements?

Use JSON Web Tokens (JWTs) signed by a central identity provider for every service-to-service call.

Share a single static API key among all services for simplicity.

Implement a service mesh with mutual TLS (mTLS) and a certificate authority for service identity.

Use a central API gateway to authenticate all requests and forward the identity to the backend services.

Which of the following is a typical security concern that is unique to IaaS compared to traditional on-premises data centers?

The requirement to install antivirus on physical hosts

The risk of unauthorized access to the hypervisor

The need to manage BIOS firmware updates on servers

The need to physically secure server racks

What is a common security challenge in IoT devices?

Constrained resources limit the use of strong encryption

They are not connected to the internet

They do not require authentication

In the security chain of responsibility, which role typically holds ultimate accountability for an organization's overall security posture?

Senior management and the board of directors

Which security control is most critical to implement on each node in a mesh network to prevent unauthorized access?

A network intrusion detection system (IDS) placed at the network gateway

A demilitarized zone (DMZ) to isolate the mesh network from the internet

Mutual authentication between each pair of communicating nodes

A strong password policy for the network administrator account

Certified Secure Software Lifecycle Professional

Domain 4Objective 1

Define the Security Architecture CSSLP Practice Questions (Page 19)

Part of the Secure Software Architecture and Design domain, which accounts for 15% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 2–3 from this objective — we provide 117 practice questions to prepare you well beyond it. (estimate)

117questions here

24free pages

43concepts

15%of the exam

43 Concepts in This Objective

SABSA framework
Security chain of responsibility
Federated identity
Security controls identification
Security controls prioritization
Client-server architecture
Peer-to-peer (P2P) architecture
Message queuing architecture
N-tier architecture
Service-oriented architecture (SOA)
Enterprise service bus (ESB)
Web services security
Microservices security
Client-side exploits and threats
Remote code execution risks
Constant connectivity implications
IoT security fundamentals
Wireless security
Location-based services security
RFID security
NFC security
Sensor networks security
Mesh network security
Secure boot
Secure memory
Secure update
SaaS security
PaaS security
IaaS security
Implicit data collection privacy
Side-channel mitigation
Speculative execution mitigation
Secure element
Firmware security
Driver security
AI security
Virtual reality security
Augmented reality security
Facility-related IoT security
Automotive IoT security
Robotics security
Medical device security
Software-defined production processes

Questions 91–95

91expert · hard
A company is migrating from a monolithic application to a microservices architecture. The security architect must design a solution for service-to-service authentication and authorization. The company wants to avoid a central point of failure and ensure that each service can independently verify the identity of the calling service. Which approach best meets these requirements?
Select an answer first
92foundation · easy
Which of the following is a typical security concern that is unique to IaaS compared to traditional on-premises data centers?
Select an answer first
93foundation · easy
What is a common security challenge in IoT devices?
Select an answer first
94foundation · easy
In the security chain of responsibility, which role typically holds ultimate accountability for an organization's overall security posture?
Select an answer first
95foundation · easy
Which security control is most critical to implement on each node in a mesh network to prevent unauthorized access?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.