A company is designing a remote access solution for employees. The security team requires strong authentication and encryption, but employees complain that the current solution is too slow and difficult to use. Which approach best balances security and usability?

Implement single sign-on (SSO) with MFA and a modern VPN client that supports split tunneling.

Remove MFA and rely on a strong password policy.

Use a legacy VPN client with no split tunneling and require MFA on every connection.

Disable encryption for all remote traffic to improve speed.

A security architect has specified a constraint that all user authentication must use multi-factor authentication (MFA). The development team has implemented the login module. Which validation activity best verifies that this constraint is met?

Check the user interface for a password field.

Perform a penetration test on the login page.

Conduct a code review of the authentication module to ensure MFA is invoked.

Review the system's performance metrics.

Certified Secure Software Lifecycle Professional

Domain 4Objective 6

Model (non-Functional) Security Properties and Constraints CSSLP Practice Questions (Page 5)

Part of the Secure Software Architecture and Design domain, which accounts for 15% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 2–3 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

5concepts

15%of the exam

Questions 21–25

21application · medium
A financial services firm is designing a new transaction processing system. The architecture team wants to ensure that every transaction can be traced back to the user who initiated it, and that no user can deny having performed a transaction. Which non-functional security property must be explicitly modeled in the architecture?
Select an answer first
22application · medium
A company is building a system that processes financial transactions. The system must ensure that a transaction cannot be altered after it is recorded. Which non-functional security property is most directly required?
Select an answer first
23expert · hard
A company is designing a remote access solution for employees. The security team requires strong authentication and encryption, but employees complain that the current solution is too slow and difficult to use. Which approach best balances security and usability?
Select an answer first
24foundation · easy
Which technique is commonly used to model non-functional security properties in software architecture by identifying potential threats and vulnerabilities?
Select an answer first
25application · medium
A security architect has specified a constraint that all user authentication must use multi-factor authentication (MFA). The development team has implemented the login module. Which validation activity best verifies that this constraint is met?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.

Model (non-Functional) Security Properties and Constraints CSSLP Practice Questions (Page 5)

Questions 21–25

A company is building a system that processes financial transactions. The system must ensure that a transaction cannot be altered after it is recorded. Which non-functional security property is most directly required?

A company is designing a remote access solution for employees. The security team requires strong authentication and encryption, but employees complain that the current solution is too slow and difficult to use. Which approach best balances security and usability?

Which technique is commonly used to model non-functional security properties in software architecture by identifying potential threats and vulnerabilities?

A security architect has specified a constraint that all user authentication must use multi-factor authentication (MFA). The development team has implemented the login module. Which validation activity best verifies that this constraint is met?

Keep studying — Secure Software Architecture and Design