Which principle is an example of open design in practice?

Peer review of security mechanisms

Relying on security through obscurity

A critical infrastructure system uses a redundant pair of servers in an active-passive configuration. The passive server is identical to the active server and is located in the same data center. The security team is concerned about a single point of failure. Which improvement best addresses this concern?

Use a load balancer to distribute traffic between the two servers

Implement failover between the two servers

Add a third server to the cluster

Place the passive server in a different geographic location

A web application caches user credentials in a client-side cookie to avoid re-authentication on every request. A security review flags this as a violation of complete mediation. What is the most appropriate remediation?

Encrypt the cookie with a strong algorithm

Store the credential in a server-side cache instead

Remove the credential cache and require authentication for every request

Certified Secure Software Lifecycle Professional

Domain 1Objective 2

Understand Security Design Principles CSSLP Practice Questions (Page 5)

Part of the Secure Software Concepts domain, which accounts for 12% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–14 in this domain), expect 4–7 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

10concepts

12%of the exam

Questions 21–25

21foundation · easy
Which implementation of segregation of duties involves splitting a secret into multiple parts, each held by a different person?
Select an answer first
22foundation · easy
Which principle is an example of open design in practice?
Select an answer first
23foundation · easy
Which security principle states that the security of a system should not depend on the secrecy of its design?
Select an answer first
24expert · hard
A critical infrastructure system uses a redundant pair of servers in an active-passive configuration. The passive server is identical to the active server and is located in the same data center. The security team is concerned about a single point of failure. Which improvement best addresses this concern?
Select an answer first
25application · medium
A web application caches user credentials in a client-side cookie to avoid re-authentication on every request. A security review flags this as a violation of complete mediation. What is the most appropriate remediation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.

Understand Security Design Principles CSSLP Practice Questions (Page 5)

Questions 21–25

Which implementation of segregation of duties involves splitting a secret into multiple parts, each held by a different person?

Which principle is an example of open design in practice?

Which security principle states that the security of a system should not depend on the secrecy of its design?

A web application caches user credentials in a client-side cookie to avoid re-authentication on every request. A security review flags this as a violation of complete mediation. What is the most appropriate remediation?

Keep studying — Secure Software Concepts