CSSLP Secure Software Architecture And Design Practice Test 3 — 15 Questions

Question 1

When designing an application that relies on external APIs, which THREE of the following are necessary security considerations?

Accepted Answer

Managing API keys using a secure vault.. Option B is correct because API keys are credentials that grant access to external services, and storing them in a secure vault (e.g., HashiCorp Vault, AWS Secrets Manager, Azure Key Vault) prevents exposure through source code, config files, or logs. Option D is correct because data returned by an external API is untrusted input; validating and sanitizing it before processing defends against injection attacks, malformed payloads, and downstream data corruption. Option E is correct because HTTPS/TLS encrypts data in transit, providing confidentiality and integrity and preventing man-in-the-middle attacks, eavesdropping, and credential theft over the network. Option A is not a security consideration—plain HTTP transmits data unencrypted and is less secure, not faster in any security-relevant sense. Option C is not a security consideration and is in fact poor practice, since hard-coding endpoint URLs reduces flexibility and can expose internal or non-production endpoints; endpoint configuration should be externalized and managed securely.

Answer

Only using HTTP for faster communication.

Answer

Hard-coding the API endpoint URLs in the application.

Question 2

Which TWO of the following design choices mitigate the risk of 'Broken Object-Level Authorization' (BOLA)?

Accepted Answer

Using random, non-predictable UUIDs for resource identifiers.. Option C is correct because using random, non-predictable UUIDs (e.g., UUIDv4) for resource identifiers makes it impractical for an attacker to guess or enumerate other users' object IDs, removing the easy ID-guessing vector that BOLA exploits. Option E is correct because BOLA fundamentally occurs when an API endpoint accepts an object ID and returns/modifies it without checking that the authenticated session user actually owns or is authorized for that object; explicitly verifying that the session's user ID matches the owner of the requested resource ID enforces object-level authorization on every request. Option A is wrong because sequentially incrementing IDs are trivially enumerable, making it easy to probe other users' objects. Option B is wrong because hiding objects in the frontend provides no security—attackers can call the API directly, bypassing any UI concealment. Option D is wrong because base64 is an encoding, not encryption or randomization; base64-encoded IDs are reversible and predictable, so they do not prevent enumeration or unauthorized access.

Answer

Using sequentially incrementing IDs (e.g., 1, 2, 3) for all resources.

Answer

Relying on the frontend to hide sensitive objects.

Answer

Using base64 encoded strings for all database IDs.

Question 3

A healthcare SaaS provider is designing a multi-tenant web application where each hospital customer's data must remain logically isolated. The design team proposes using a single shared database schema with a tenant identifier column on every table, enforced by application-layer query filters. A security architect must evaluate this proposal. Which design concern is the MOST significant risk with this approach?

Accepted Answer

A defect in any single query filter can expose one tenant's records to another tenant, because isolation depends entirely on application code being correct in every data access path.. Application-enforced tenant filtering places the entire isolation guarantee inside code that changes constantly, so any missed predicate, raw SQL query, or new feature path can leak one hospital's records to another. Database-enforced controls such as row-level security or schema-per-tenant provide a backstop that survives application defects. The dominant design risk is therefore the absence of a defense-in-depth boundary, not encryption, performance, or a non-existent regulatory mandate.

Answer

A tenant identifier column prevents the database from using indexes effectively, causing query performance to degrade until row-level security can be introduced.

Answer

Multi-tenant applications built on a single schema cannot meet HIPAA because the regulation explicitly requires physically separate databases for each covered entity.

Answer

Shared schemas cannot support per-tenant encryption keys, so data at rest would necessarily be stored in plaintext across all hospital customers.

Question 4

A financial services firm is designing a new internal microservices platform. The architecture team wants to reduce the blast radius of a compromised service account while still allowing services to authenticate to one another. Which TWO design measures best support this goal? (Choose two.)

Accepted Answer

Issue each service a distinct workload identity with short-lived credentials and narrowly scoped permissions, so a stolen token grants access only to that service's own resources.. Reducing blast radius requires that a compromised service cannot act as other services and cannot reach resources beyond its own scope. Distinct short-lived workload identities enforce least privilege per service, while mutual TLS ensures every call is cryptographically tied to a verified peer. Together they contain the damage of any single compromise. Shared credentials, network-only isolation, and extended token lifetimes all weaken containment by broadening what a stolen identity can do.

Answer

Store a single shared service account credential in a central secrets vault and inject it into every service at startup to simplify rotation.

Answer

Rely on the Kubernetes NetworkPolicy default-deny rule to prevent a compromised service from reaching any other service, since network isolation alone removes the need for service-level authentication.

Answer

Increase the token lifetime for all service credentials to 24 hours so that rotation outages do not disrupt inter-service calls during business hours.

Question 5

A development team is designing a desktop application that must call a third-party payment API. The vendor requires the application to prove its identity to the API using a shared secret. A junior engineer proposes embedding the secret directly in the compiled client binary. The security architect must recommend a design change. Which approach best addresses the underlying design flaw?

Accepted Answer

Route the payment call through a server-side component that holds the secret and authenticates to the payment API on the client's behalf.. A secret embedded in a client binary is inside a trust boundary controlled by the attacker, so no amount of obfuscation, local storage, or transport encryption makes it safe. The correct design moves the privileged credential to a server-side broker that the client calls, keeping the vendor secret out of the untrusted environment. This is the standard pattern for public clients that must reach an API requiring a confidential credential.

Answer

Obfuscate the binary and encrypt the embedded secret with a hardcoded key so that casual inspection tools cannot recover it.

Answer

Store the secret in the operating system credential manager on the user's machine and have the application read it at runtime.

Answer

Require the client to send the secret over TLS so that network eavesdroppers cannot capture it in transit.

Question 6

A software architect is designing a multi-tenant SaaS application that must prevent a user from one tenant from accessing another tenant's data through the application's API. The architect wants to enforce this isolation at the architectural level rather than relying on developers to remember to include a tenant filter in every query. Which design approach best achieves this goal?

Accepted Answer

Implement row-level security (RLS) policies in the database that automatically filter data based on the tenant identity associated with the current session.. Row-level security is a database-enforced access control mechanism that automatically restricts which rows a session can see or modify based on a security predicate. By tying the predicate to the tenant identity, the database becomes the enforcement point, so application bugs cannot easily bypass isolation. This is a strong architectural control for multi-tenant isolation.

Answer

Require developers to use a shared data access library that always adds a tenant_id parameter to every SQL query.

Answer

Encrypt each tenant's data with a unique encryption key and store the keys in a hardware security module (HSM).

Answer

Assign each tenant a separate database schema and require the application to connect with a schema-specific database user.

Question 7

A financial services firm is designing a new web application that will allow customers to transfer funds between accounts. The security architect has mandated that the application must enforce the principle of 'least privilege' for all user actions. Which design approach best achieves this?

Accepted Answer

Assign each user a role with the minimum permissions necessary to perform their job functions, and regularly review role assignments.. Least privilege requires that users and processes operate with only the permissions essential to their function. Assigning minimal role-based permissions and conducting regular reviews ensures that access remains tightly scoped over time. The other options either grant excessive permissions, share accounts broadly, or automate elevation without oversight, all of which violate the principle.

Answer

Implement a single administrative account with full access to all application functions, and require strong multi-factor authentication for its use.

Answer

Use a shared service account for all application components to simplify permission management and reduce administrative overhead.

Answer

Allow users to request additional permissions through a self-service portal that automatically grants access after a short delay.

Question 8

A security architect is reviewing the design of a payment processing system that uses a message queue to decouple services. The architect wants to ensure that if a message is intercepted and modified in transit, the receiving service can detect the tampering and reject the message. The system already uses TLS for transport encryption. Which additional design control best provides end-to-end integrity for the message payload?

Accepted Answer

Digitally sign the message payload with the sender's private key and have the receiver verify the signature using the sender's public key.. Digital signatures bind the message content to the sender's private key, so any modification invalidates the signature. Unlike transport-layer protections, a signature remains verifiable after the message leaves the TLS tunnel and is stored in a queue. This provides end-to-end integrity and authenticity, which is critical for payment messages that may traverse multiple services.

Answer

Enable TLS mutual authentication (mTLS) between the sender and the message queue and between the queue and the receiver.

Answer

Encrypt the message payload with a symmetric key shared between the sender and receiver before placing it on the queue.

Answer

Use a message authentication code (MAC) with a key shared between all services that interact with the queue.

Question 9

A healthcare organization is designing a system to store and process electronic protected health information (ePHI). The system must comply with HIPAA and ensure data confidentiality at rest. Which cryptographic design choice is most appropriate?

Accepted Answer

Encrypt the data using AES-256 in Galois/Counter Mode (GCM) with a unique key per data record, and store the keys in a hardware security module (HSM).. For protecting ePHI at rest, symmetric encryption with AES-256-GCM offers both confidentiality and integrity, and using a unique key per record with HSM-based key storage ensures strong key management. The other options either use asymmetric encryption inefficiently, apply hashing which is irreversible, or rely on encoding without encryption, all of which fail to meet the confidentiality requirement.

Answer

Hash the data using SHA-256 with a salt, and store the hash in the database to protect confidentiality.

Answer

Encrypt the data using RSA-2048 with OAEP padding, and store the private key in a configuration file on the application server.

Answer

Encode the data using Base64 encoding, and rely on network-level encryption to protect it at rest.

Question 10

A software development team is designing a new internal employee portal. The security architect recommends implementing the principle of least privilege. Which design decision best applies this principle to the portal's database access?

Accepted Answer

Create a dedicated database account for the portal that has only the specific SELECT, INSERT, UPDATE, and DELETE permissions required on the tables the portal uses.. Least privilege means giving an entity only the access required to perform its function. A dedicated database account with a minimal set of DML permissions on specific tables ensures the portal can operate without granting unnecessary rights. This reduces the impact of a compromise and is a fundamental secure design practice.

Answer

Grant the portal's database account full administrative rights so that developers can quickly fix data issues without waiting for DBA approval.

Answer

Allow the portal to connect as the database schema owner so that it can create temporary tables and stored procedures as needed.

Answer

Use a shared database account for all internal applications so that connection strings are easier to manage and rotate.

Question 11

A software development team is beginning a new project and wants to integrate security into the design phase. Which activity is most effective for identifying potential security requirements early in the software development lifecycle (SDLC)?

Accepted Answer

Performing threat modeling sessions with the architecture team.. Threat modeling is a proactive design-phase activity that systematically identifies threats and derives security requirements. It involves understanding the system architecture, identifying assets and trust boundaries, and enumerating potential threats. This early analysis allows the team to incorporate appropriate security controls into the design, reducing vulnerabilities and remediation costs. The other options are later-stage activities that do not fulfill the goal of early security requirement identification.

Answer

Deploying a web application firewall (WAF) to protect the application in production.

Answer

Conducting a penetration test on a prototype of the application.

Answer

Reviewing the source code for common vulnerabilities using static analysis tools.

Question 12

A security architect is designing a new web application that will handle sensitive customer data. The architect wants to incorporate the principle of 'defense in depth' into the architecture. Which TWO of the following design decisions best exemplify defense in depth? (Choose two.)

Accepted Answer

Implement input validation at both the presentation layer and the business logic layer.. Defense in depth means layering multiple independent security controls so that if one fails, others still protect the asset. Validating input at multiple layers and combining network restrictions with data encryption are both examples of redundant, complementary controls. They reduce the risk of a single control failure leading to a breach.

Answer

Use a single, strong authentication mechanism such as multi-factor authentication for all users.

Answer

Rely on a Web Application Firewall (WAF) as the primary control to block all attacks against the application.

Answer

Store all application logs on the same server as the application to simplify troubleshooting.

Question 13

A healthcare SaaS provider is designing a multi-tenant system where each tenant's data is stored in a shared database. To prevent one tenant from accessing another tenant's records, the design team decides to enforce isolation at the data-access layer. Which secure design approach best ensures tenant isolation while maintaining a single logical database?

Accepted Answer

Implement row-level security (RLS) policies in the database that automatically filter rows based on the tenant identifier associated with the authenticated session.. Row-level security (RLS) enforces tenant isolation directly in the database engine, automatically filtering data based on the authenticated tenant context. This provides a strong, centralized control that is not dependent on application code correctness, reducing the risk of cross-tenant data leakage. It aligns with the principle of defense in depth and is well-suited for multi-tenant architectures with shared databases.

Answer

Use a separate database schema for each tenant within the same database instance, and grant each tenant's application role access only to its own schema.

Answer

Rely on application code to always include a WHERE clause filtering by tenant ID in every query, and perform code reviews to ensure compliance.

Answer

Encrypt each tenant's data with a unique encryption key and store the keys in a hardware security module (HSM), decrypting only after the application retrieves the data.

Question 14

A company is designing a microservices-based e-commerce platform. The security team wants to ensure that if one microservice is compromised, the attacker cannot easily move laterally to other services. Which design pattern best addresses this concern?

Accepted Answer

Service mesh with mutual TLS (mTLS) and fine-grained access policies.. A service mesh with mTLS and fine-grained access policies provides strong identity-based authentication and authorization for service-to-service communication. By enforcing least privilege and encrypting traffic, it prevents a compromised microservice from accessing other services without proper credentials. This segmentation is key to containing breaches and limiting lateral movement, unlike centralized gateways or shared databases that do not enforce internal segmentation.

Answer

Shared database with a single set of credentials for all microservices.

Answer

Client-side load balancing with direct service-to-service calls.

Answer

API gateway with centralized authentication and authorization.

Question 15

A software architect is designing a system that uses a third-party library to parse complex file formats. The library has had several critical vulnerabilities in the past. The architect wants to reduce the risk of a zero-day vulnerability in the library compromising the entire application. Which design approach best mitigates this risk?

Accepted Answer

Run the file parsing library in a separate process with minimal privileges and communicate with the main application via a restricted interface.. Running a risky component in an isolated process with minimal privileges is a sandboxing technique that contains the damage from a zero-day. Even if the library is exploited, the attacker is confined to that process and cannot easily access the rest of the application or system. This is a proactive architectural mitigation.

Answer

Wrap the library in a custom abstraction layer that validates all inputs and outputs to ensure they conform to expected formats.

Answer

Require the library to be updated to the latest version as soon as patches are available and monitor vulnerability feeds.

Answer

Perform static code analysis on the library's source code before each release to identify potential vulnerabilities.