Model (non-Functional) Security Properties and Constraints CSSLP Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company is deploying a new internal application. The security team requires that all user activity be logged for audit purposes. The operations team is concerned about the storage cost of logs and the performance impact of logging. Which design decision best balances the security requirement with operational constraints?

   • ADisable logging to improve performance.
   • BLog every single user action in full detail.
   • CLog only successful logins and ignore all other events.
   • DLog all security-relevant events, such as authentication failures and permission changes, and retain them for a defined period.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security architect has specified that all data at rest must be encrypted. The development team has implemented encryption using a custom algorithm. During a design review, the architect must validate that the constraint is met. Which action is most appropriate?

   • AReject the custom algorithm and require the use of a well-vetted standard algorithm like AES.
   • BDefer the decision to the development team.
   • CAccept the custom algorithm because it is unique and harder to break.
   • DApprove the implementation after a quick code review.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which architectural view is most useful for modeling how security properties like authentication and authorization are enforced across system components?

   • ASecurity view
   • BDeployment view
   • CLogical view
   • DProcess view
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which activity is specifically used to validate that an architectural design meets its security constraints?

   • APerformance benchmarking
   • BUnit testing
   • CSecurity architecture review
   • DUser acceptance testing
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security architect has specified a constraint that all error messages must not reveal sensitive system details. The development team has implemented error handling. Which validation activity is most effective in verifying this constraint?

   • ARunning a performance test on the error handling module.
   • BReviewing the user manual for error message descriptions.
   • CChecking the error messages for spelling mistakes.
   • DPerforming a security review of the error handling code.
   Reveal Solution Discussion Select an answer first