A software architect is using threat modeling to identify potential security issues in a new online banking system. Which activity is part of modeling security properties in the architecture?

Creating data flow diagrams to identify trust boundaries and potential attack surfaces.

Calculating the total cost of ownership.

Writing unit tests for the login module.

Deploying the system to production.

A government agency is deploying a new case management system. The system must be available during business hours for caseworkers, but the data is highly sensitive and must be protected from unauthorized access. The agency has a limited budget and cannot afford redundant infrastructure. Which trade-off is most appropriate?

Implement a full disaster recovery site with real-time replication to ensure zero downtime.

Disable all security controls to reduce complexity and improve system performance.

Prioritize availability over confidentiality, allowing any authenticated user to access all data.

Prioritize confidentiality and integrity over high availability, accepting potential downtime during non-critical periods.

Certified Secure Software Lifecycle Professional

Domain 4Objective 6

Model (non-Functional) Security Properties and Constraints CSSLP Practice Questions (Page 1)

Part of the Secure Software Architecture and Design domain, which accounts for 15% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 2–3 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

5concepts

15%of the exam

Questions 1–5

1foundation · easy
Which security property is primarily concerned with providing proof that a specific user performed a particular action, such as sending a message or approving a transaction?
Select an answer first
2foundation · easy
Which non-functional security property ensures that a system's data is not disclosed to unauthorized individuals, entities, or processes?
Select an answer first
3application · medium
A software architect is documenting the security properties of a new e-commerce platform. The platform must ensure that customer payment information is not readable by unauthorized parties during transmission. Which security property should be explicitly modeled in the architecture?
Select an answer first
4application · medium
A software architect is using threat modeling to identify potential security issues in a new online banking system. Which activity is part of modeling security properties in the architecture?
Select an answer first
5expert · hard
A government agency is deploying a new case management system. The system must be available during business hours for caseworkers, but the data is highly sensitive and must be protected from unauthorized access. The agency has a limited budget and cannot afford redundant infrastructure. Which trade-off is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.

Model (non-Functional) Security Properties and Constraints CSSLP Practice Questions (Page 1)

Questions 1–5

Which security property is primarily concerned with providing proof that a specific user performed a particular action, such as sending a message or approving a transaction?

Which non-functional security property ensures that a system's data is not disclosed to unauthorized individuals, entities, or processes?

A software architect is documenting the security properties of a new e-commerce platform. The platform must ensure that customer payment information is not readable by unauthorized parties during transmission. Which security property should be explicitly modeled in the architecture?

A software architect is using threat modeling to identify potential security issues in a new online banking system. Which activity is part of modeling security properties in the architecture?

Keep studying — Secure Software Architecture and Design