What is the primary purpose of the Common Vulnerability Scoring System (CVSS)?

To categorize threats into six distinct types

To combine different threat modeling methodologies

To simulate attacks from an attacker's perspective

To provide a standardized method for scoring the severity of vulnerabilities

What is the attack surface of a system?

The total number of vulnerabilities in the system

The sum of all entry points and attack vectors that an attacker could use

The physical perimeter of the data center

The number of users who have access to the system

A development team is designing a new microservices-based application. The architecture includes a public-facing API gateway, internal service-to-service communication, a database, and an admin dashboard that is currently exposed to the internet for convenience. The team wants to reduce the attack surface of the application. Which action is the most effective first step?

Add a web application firewall (WAF) in front of the admin dashboard.

Increase the password complexity requirements for the admin dashboard.

Move the admin dashboard to a private network and require VPN access for administrators.

Conduct a penetration test on the admin dashboard to find vulnerabilities.

Certified Secure Software Lifecycle Professional

Domain 4Objective 4

Perform Threat Modeling CSSLP Practice Questions (Page 4)

Part of the Secure Software Architecture and Design domain, which accounts for 15% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 2–3 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

11concepts

15%of the exam

Questions 16–20

16foundation · easy
What is the primary purpose of the Common Vulnerability Scoring System (CVSS)?
Select an answer first
17foundation · easy
Which of the following is a technique used to analyze potential attack paths within a system architecture?
Select an answer first
18foundation · easy
What is the attack surface of a system?
Select an answer first
19application · medium
A development team is designing a new microservices-based application. The architecture includes a public-facing API gateway, internal service-to-service communication, a database, and an admin dashboard that is currently exposed to the internet for convenience. The team wants to reduce the attack surface of the application. Which action is the most effective first step?
Select an answer first
20foundation · easy
Which type of malware is designed to spread from system to system without user interaction, often exploiting network vulnerabilities?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.

Perform Threat Modeling CSSLP Practice Questions (Page 4)

Questions 16–20

What is the primary purpose of the Common Vulnerability Scoring System (CVSS)?

Which of the following is a technique used to analyze potential attack paths within a system architecture?

What is the attack surface of a system?

Which type of malware is designed to spread from system to system without user interaction, often exploiting network vulnerabilities?

Keep studying — Secure Software Architecture and Design