Which factor is LEAST relevant when prioritizing security controls?

The potential impact of a successful attack

The cost of implementing the control

The likelihood of the threat occurring

The color scheme of the security dashboard

What is a common attack against RFID systems?

Physical destruction of the reader

Denial of service by sending too many emails

Cloning a tag to impersonate a legitimate tag

When designing the security architecture for a virtual reality (VR) application, which of the following data types should be treated as highly sensitive due to its potential to reveal intimate user information?

The user's eye movement and gaze tracking data

The user's display resolution and refresh rate settings

The user's internet connection speed and latency

The user's avatar appearance and in-world preferences

An organization is adopting a SaaS-based customer relationship management (CRM) system. Which security activity is the organization most likely to perform?

Performing a vulnerability scan of the CRM application's source code

Installing a host-based intrusion detection system on the CRM servers

Configuring the network firewall that protects the CRM application's backend database

Reviewing the provider's data protection and privacy certifications

Certified Secure Software Lifecycle Professional

Domain 4Objective 1

Define the Security Architecture CSSLP Practice Questions (Page 6)

Part of the Secure Software Architecture and Design domain, which accounts for 15% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 2–3 from this objective — we provide 117 practice questions to prepare you well beyond it. (estimate)

117questions here

24free pages

43concepts

15%of the exam

43 Concepts in This Objective

SABSA framework
Security chain of responsibility
Federated identity
Security controls identification
Security controls prioritization
Client-server architecture
Peer-to-peer (P2P) architecture
Message queuing architecture
N-tier architecture
Service-oriented architecture (SOA)
Enterprise service bus (ESB)
Web services security
Microservices security
Client-side exploits and threats
Remote code execution risks
Constant connectivity implications
IoT security fundamentals
Wireless security
Location-based services security
RFID security
NFC security
Sensor networks security
Mesh network security
Secure boot
Secure memory
Secure update
SaaS security
PaaS security
IaaS security
Implicit data collection privacy
Side-channel mitigation
Speculative execution mitigation
Secure element
Firmware security
Driver security
AI security
Virtual reality security
Augmented reality security
Facility-related IoT security
Automotive IoT security
Robotics security
Medical device security
Software-defined production processes

Questions 26–30

26foundation · easy
Which factor is LEAST relevant when prioritizing security controls?
Select an answer first
27foundation · easy
What is a common attack against RFID systems?
Select an answer first
28foundation · easy
When designing the security architecture for a virtual reality (VR) application, which of the following data types should be treated as highly sensitive due to its potential to reveal intimate user information?
Select an answer first
29foundation · easy
What is a common client-side exploit in rich internet applications?
Select an answer first
30foundation · easy
An organization is adopting a SaaS-based customer relationship management (CRM) system. Which security activity is the organization most likely to perform?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.