What is a common mitigation strategy for remote code execution vulnerabilities?

Disabling all network connections

Increasing the server's processing power

Using only client-side validation

Input validation and sanitization

What is the primary purpose of secure boot in a system's startup process?

To prevent a user from booting an alternative operating system from removable media

To encrypt the operating system's kernel and prevent unauthorized access to its code

To verify the digital signature of each boot component before it is loaded, ensuring only trusted code executes

To provide a secure channel between the bootloader and the operating system for transmitting encryption keys

Why is implicit data collection a privacy concern in software design?

It requires the use of third-party analytics services.

It prevents the application from complying with data minimization principles.

It may occur without the user's knowledge or explicit consent.

It always stores data in unencrypted databases.

What is the primary benefit of federated identity management for users?

Storing all user credentials in a single centralized database

Single sign-on across multiple organizations and domains

Eliminating the need for passwords entirely

Ensuring that all user data is encrypted in transit

Which scenario best describes implicit data collection in a software application?

An application logs the user's IP address and browser type without displaying a notice or requesting consent.

A user receives an email asking them to confirm their subscription to a newsletter.

A user fills out a registration form and submits their email address.

A user uploads a profile picture to their account settings page.

Certified Secure Software Lifecycle Professional

Domain 4Objective 1

Define the Security Architecture CSSLP Practice Questions (Page 7)

Part of the Secure Software Architecture and Design domain, which accounts for 15% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 2–3 from this objective — we provide 117 practice questions to prepare you well beyond it. (estimate)

117questions here

24free pages

43concepts

15%of the exam

43 Concepts in This Objective

SABSA framework
Security chain of responsibility
Federated identity
Security controls identification
Security controls prioritization
Client-server architecture
Peer-to-peer (P2P) architecture
Message queuing architecture
N-tier architecture
Service-oriented architecture (SOA)
Enterprise service bus (ESB)
Web services security
Microservices security
Client-side exploits and threats
Remote code execution risks
Constant connectivity implications
IoT security fundamentals
Wireless security
Location-based services security
RFID security
NFC security
Sensor networks security
Mesh network security
Secure boot
Secure memory
Secure update
SaaS security
PaaS security
IaaS security
Implicit data collection privacy
Side-channel mitigation
Speculative execution mitigation
Secure element
Firmware security
Driver security
AI security
Virtual reality security
Augmented reality security
Facility-related IoT security
Automotive IoT security
Robotics security
Medical device security
Software-defined production processes

Questions 31–35

31foundation · easy
What is a common mitigation strategy for remote code execution vulnerabilities?
Select an answer first
32foundation · easy
What is the primary purpose of secure boot in a system's startup process?
Select an answer first
33foundation · easy
Why is implicit data collection a privacy concern in software design?
Select an answer first
34foundation · easy
What is the primary benefit of federated identity management for users?
Select an answer first
35foundation · easy
Which scenario best describes implicit data collection in a software application?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.