Which practice is essential when sharing sensitive data between applications?

Sending data in plain text to reduce latency

Storing data in a shared directory with no access controls

Encrypting the data in transit and at rest, and using strong authentication between applications

Using a shared static API key that never changes

Which of the following is a common API security weakness?

Using OAuth 2.0 for authentication

Implementing input validation on all parameters

Using HTTPS for all communications

Lack of rate limiting, allowing attackers to brute-force credentials

What is a common cause of session hijacking in protocol design?

Using HTTPS for session transmission

Using secure cookies with the HttpOnly flag

Using predictable session identifiers

A software company is integrating a payment processing API from a third-party vendor into their e-commerce platform. The integration requires sharing customer order data and a shared API key. The vendor's API is critical for order processing. What should the company do to manage this dependency securely?

Store the shared API key in a configuration file and share it with all developers for convenience.

Send all order data to the vendor in plaintext to simplify integration and reduce latency.

Avoid using the vendor's API and build all payment processing in-house to eliminate the dependency.

Use a secrets management service to store the API key and rotate it regularly, and implement a fallback mechanism for API failures.

What is the primary purpose of requiring authentication, authorization, and encryption on security management interfaces?

To ensure that only authorized administrators can access and control the system securely

To eliminate the need for audit logging on management activities

To allow any user to view system configuration without restrictions

To improve system performance by reducing the number of management requests

Certified Secure Software Lifecycle Professional

Domain 4Objective 2

Perform Secure Interface Design CSSLP Practice Questions (Page 1)

Part of the Secure Software Architecture and Design domain, which accounts for 15% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 2–3 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

9concepts

15%of the exam

Questions 1–5

1foundation · easy
Which practice is essential when sharing sensitive data between applications?
Select an answer first
2foundation · easy
Which of the following is a common API security weakness?
Select an answer first
3foundation · easy
What is a common cause of session hijacking in protocol design?
Select an answer first
4application · medium
A software company is integrating a payment processing API from a third-party vendor into their e-commerce platform. The integration requires sharing customer order data and a shared API key. The vendor's API is critical for order processing. What should the company do to manage this dependency securely?
Select an answer first
5foundation · easy
What is the primary purpose of requiring authentication, authorization, and encryption on security management interfaces?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.