In a software-defined production environment, which architectural approach best supports the principle of least privilege for the software components that control production?

Embedding credentials directly in the production software code for ease of deployment.

Providing all production services with the same broad permissions to avoid permission-related errors.

Using a single shared administrative account for all production control services to simplify management.

Granting each production control service only the permissions required for its specific function, with separate identities for each service.

A large enterprise is adopting a service-oriented architecture (SOA) to expose internal business functions as services. The architecture team is deciding between using WS-Security for message-level security or relying solely on TLS for transport-level security. The services will handle sensitive financial data and must support non-repudiation and end-to-end security across multiple intermediaries. Which approach is the most appropriate?

Use TLS exclusively, as it provides strong encryption and is simpler to manage.

Use WS-Security with digital signatures and encryption to provide end-to-end message-level security.

Use a combination of TLS and API keys for authentication.

Use a VPN between all service consumers and providers.

What is the primary purpose of the Sherwood Applied Business Security Architecture (SABSA) framework?

To replace other security frameworks like ISO 27001 and NIST

To provide a methodology for aligning security architecture with business requirements and goals

To define a set of mandatory security controls that all organizations must implement

To focus exclusively on technical security controls and network architecture

Which attack is secure boot specifically designed to mitigate?

A rootkit that replaces the bootloader to load malicious code before the operating system starts

Denial-of-service (DoS) attacks on a network service

Phishing attacks that trick users into revealing credentials

SQL injection against a web application

Which of the following is a primary security concern when deploying IoT devices in a facility environment?

Devices use only proprietary protocols that cannot be intercepted

Devices may have default credentials that are not changed during installation

Devices are typically powered by batteries, so they cannot support encryption

Devices are always connected through fiber-optic cables, which are difficult to tap

Certified Secure Software Lifecycle Professional

Domain 4Objective 1

Define the Security Architecture CSSLP Practice Questions (Page 4)

Part of the Secure Software Architecture and Design domain, which accounts for 15% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 2–3 from this objective — we provide 117 practice questions to prepare you well beyond it. (estimate)

117questions here

24free pages

43concepts

15%of the exam

43 Concepts in This Objective

SABSA framework
Security chain of responsibility
Federated identity
Security controls identification
Security controls prioritization
Client-server architecture
Peer-to-peer (P2P) architecture
Message queuing architecture
N-tier architecture
Service-oriented architecture (SOA)
Enterprise service bus (ESB)
Web services security
Microservices security
Client-side exploits and threats
Remote code execution risks
Constant connectivity implications
IoT security fundamentals
Wireless security
Location-based services security
RFID security
NFC security
Sensor networks security
Mesh network security
Secure boot
Secure memory
Secure update
SaaS security
PaaS security
IaaS security
Implicit data collection privacy
Side-channel mitigation
Speculative execution mitigation
Secure element
Firmware security
Driver security
AI security
Virtual reality security
Augmented reality security
Facility-related IoT security
Automotive IoT security
Robotics security
Medical device security
Software-defined production processes

Questions 16–20

16foundation · easy
In a software-defined production environment, which architectural approach best supports the principle of least privilege for the software components that control production?
Select an answer first
17expert · hard
A large enterprise is adopting a service-oriented architecture (SOA) to expose internal business functions as services. The architecture team is deciding between using WS-Security for message-level security or relying solely on TLS for transport-level security. The services will handle sensitive financial data and must support non-repudiation and end-to-end security across multiple intermediaries. Which approach is the most appropriate?
Select an answer first
18foundation · easy
What is the primary purpose of the Sherwood Applied Business Security Architecture (SABSA) framework?
Select an answer first
19foundation · easy
Which attack is secure boot specifically designed to mitigate?
Select an answer first
20foundation · easy
Which of the following is a primary security concern when deploying IoT devices in a facility environment?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.