Perform Architectural Risk Assessment and Design Reviews CSSLP Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security team is analyzing risks for a new online payment system. They have identified a risk that a SQL injection vulnerability in the payment processing module could allow an attacker to access the entire customer database. They estimate the likelihood of exploitation as high and the impact as severe. What should the team do next?

   • ADefer the risk until after the system is released.
   • BTransfer the risk to a third-party vendor.
   • CPrioritize this risk for immediate mitigation.
   • DAccept the risk because the system is new.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company is conducting an architectural risk assessment for a new e-commerce platform. The team has identified the following risks: (1) a potential SQL injection in the product search feature, (2) a lack of encryption for customer payment data at rest, and (3) a denial of service vulnerability in the API. The company has limited resources and can only mitigate two of the three risks in the current release. Which two risks should be prioritized for mitigation?

   • AAll three risks are equally important and should be mitigated.
   • BSQL injection and denial of service
   • CLack of encryption at rest and denial of service
   • DSQL injection and lack of encryption at rest
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company is conducting a design review for a new customer-facing application that will handle sensitive personal data. The review team is composed of the lead architect, a security engineer, and a project manager. The team is evaluating the architecture against security requirements. Which approach is most effective for the design review?

   • AHave the team review the architecture together in a single meeting.
   • BHave the lead architect present the architecture and answer questions from the team.
   • CHave the project manager review the architecture to ensure it meets business requirements.
   • DHave the security engineer independently review the architecture and present findings to the team.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A development team is about to begin a design review for a new customer portal. The security lead wants to ensure that the review is effective. Which step is most important to include in the design review process?

   • AReviewing the architecture against a set of security requirements and best practices.
   • BInterviewing end users about their needs.
   • CReviewing the project budget and timeline.
   • DRunning a vulnerability scanner on the code.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A large enterprise is adopting a microservices architecture for a new customer-facing application. The security team is integrating architectural risk assessment and design reviews into the development process. The team is concerned about the risk of an attacker exploiting a vulnerability in one service to access data in another service. They want to implement a mitigation that is both effective and does not significantly impact performance. Which approach is most appropriate?

   • AImplement strict network segmentation between services and enforce least privilege access controls.
   • BUse a single shared database for all services to simplify access control.
   • CConduct a design review only after the architecture is fully implemented.
   • DEncrypt all data at rest and in transit.
   Reveal Solution Discussion Select an answer first