When identifying security controls, what is the first step in the process?

Purchase and deploy security software

Conduct a penetration test on the system

Analyze the architectural requirements to identify potential threats and risks

A multinational bank is redesigning its security architecture. The CISO wants to ensure that every security control can be traced back to a specific business objective, and that each control has a clearly identified owner who is accountable for its operation. The architecture team has been asked to produce a framework that links business drivers to security services and also defines the chain of responsibility. Which approach best satisfies this requirement?

Implement a TOGAF-based architecture that focuses primarily on IT infrastructure and data flow diagrams.

Deploy a GRC tool to track compliance findings and automatically assign remediation tasks to system administrators.

Create a security policy document that lists all controls and assigns each to the IT security team.

Adopt the SABSA framework, mapping business attributes to security services and defining accountability in the SABSA layers.

Which of the following is a distinct security concern introduced by AI/ML systems that a security architect should address?

Adversarial manipulation of input data to cause misclassification

Denial of service via network flooding

Cross-site scripting in the user interface

SQL injection in the database layer

What is a common mitigation for privacy risks in location-based services?

Obtaining explicit user consent before collecting location data

Collecting location data without informing the user

Storing location data indefinitely

Sharing location data with third parties without consent

Certified Secure Software Lifecycle Professional

Domain 4Objective 1

Define the Security Architecture CSSLP Practice Questions (Page 23)

Part of the Secure Software Architecture and Design domain, which accounts for 15% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 2–3 from this objective — we provide 117 practice questions to prepare you well beyond it. (estimate)

117questions here

24free pages

43concepts

15%of the exam

43 Concepts in This Objective

SABSA framework
Security chain of responsibility
Federated identity
Security controls identification
Security controls prioritization
Client-server architecture
Peer-to-peer (P2P) architecture
Message queuing architecture
N-tier architecture
Service-oriented architecture (SOA)
Enterprise service bus (ESB)
Web services security
Microservices security
Client-side exploits and threats
Remote code execution risks
Constant connectivity implications
IoT security fundamentals
Wireless security
Location-based services security
RFID security
NFC security
Sensor networks security
Mesh network security
Secure boot
Secure memory
Secure update
SaaS security
PaaS security
IaaS security
Implicit data collection privacy
Side-channel mitigation
Speculative execution mitigation
Secure element
Firmware security
Driver security
AI security
Virtual reality security
Augmented reality security
Facility-related IoT security
Automotive IoT security
Robotics security
Medical device security
Software-defined production processes

Questions 111–115

111foundation · easy
When identifying security controls, what is the first step in the process?
Select an answer first
112application · medium
A multinational bank is redesigning its security architecture. The CISO wants to ensure that every security control can be traced back to a specific business objective, and that each control has a clearly identified owner who is accountable for its operation. The architecture team has been asked to produce a framework that links business drivers to security services and also defines the chain of responsibility. Which approach best satisfies this requirement?
Select an answer first
113foundation · easy
Which of the following is a distinct security concern introduced by AI/ML systems that a security architect should address?
Select an answer first
114foundation · easy
Which standard is specifically designed to provide security for web services?
Select an answer first
115foundation · easy
What is a common mitigation for privacy risks in location-based services?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.

Define the Security Architecture CSSLP Practice Questions (Page 23)

Questions 111–115

When identifying security controls, what is the first step in the process?

Which of the following is a distinct security concern introduced by AI/ML systems that a security architect should address?

Which standard is specifically designed to provide security for web services?

What is a common mitigation for privacy risks in location-based services?

Keep studying — Secure Software Architecture and Design