Perform Architectural Risk Assessment and Design Reviews CSSLP Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is a benefit of combining risk assessment and design review activities?

   • ASecurity issues are addressed before they become costly to fix
   • BThe need for security expertise is eliminated
   • CThe design review process becomes shorter
   • DThe architecture becomes more complex
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   During a design review of a new file-sharing application, the reviewer notices that the application uses a shared signing key for all JWT tokens issued to users. What is the primary security concern with this design?

   • AThe tokens will not be encrypted.
   • BIf the signing key is compromised, an attacker can forge tokens for any user.
   • CThe tokens will be too large for the network.
   • DThe tokens will expire too quickly.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   When conducting a design review, what should the reviewer evaluate the architecture against?

   • ASecurity requirements and best practices
   • BThe team's coding preferences
   • CThe marketing strategy
   • DThe project budget
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company is designing a new mobile banking application. The architecture includes a mobile app, a backend API, and a database. The risk assessment identifies that the API does not enforce rate limiting, making it vulnerable to denial of service attacks. Which mitigation strategy is most appropriate?

   • AImplement rate limiting at the API gateway.
   • BEncrypt all data in transit.
   • CMove the API to a different hosting provider.
   • DUse a more secure authentication method.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A software company is conducting an architectural risk assessment for a new cloud-based document management system. The team has identified several risks: (1) a vulnerability in the file upload feature that could allow malicious files to be stored, (2) a lack of encryption for data at rest, and (3) a potential denial of service attack on the public API. The team needs to prioritize these risks for mitigation. Which approach is most appropriate for prioritizing these risks?

   • AFocus only on the risks that are easiest to mitigate, regardless of impact.
   • BPrioritize based on the order in which the risks were identified.
   • CRank the risks based on the likelihood of occurrence and the potential impact on the business.
   • DMitigate all risks equally because they are all important.
   Reveal Solution Discussion Select an answer first