Official (ISC)² CSSLP - Domain 3: Secure
Software Design UPDATED ACTUAL Exam
Questions and CORRECT Answers
3-Tier architecture - CORRECT ANSWER - A form of distributed computing in which
client intelligence is moved to a middle tier so that stateless clients can be used.
Client-server architecture - CORRECT ANSWER - A form of distributed computing in
which client code contacts the server for data, then formats and displays it to the use. Input from
the client is committed back to the server when it represents a permanent change.
Cloud computing - CORRECT ANSWER - A computing model that enables convenient,
on-demand network access to a shared pool of configurable computing resources (e.g., networks,
servers, storage, applications, and services) that can be rapidly provisioned and released with
minimal management effort or service provider interaction.
Defense-in-depth - CORRECT ANSWER - A security principle in which multiple layers of
controls and risk-mitigation countermeasures are incorporated so that there is no single point of
complete compromise.
Discretionary Access Control - CORRECT ANSWER - A means of restricting access to
objects based on the identity of subjects and groups to which they belong. The controls are
discretionary in the sense that a subject with certain access permission is capable of passing that
permission on to another subject.
Economy of mechanism - CORRECT ANSWER - A security principle that states that the
more complex the design is, the more likelihood there is of vulnerabilities; keeping the software
design small and simple decreases attack surface and has fewer
weak links.
Enterprise service bus - CORRECT ANSWER - A software architecture model used for
designing and implementing the interaction and communication
Software Design UPDATED ACTUAL Exam
Questions and CORRECT Answers
3-Tier architecture - CORRECT ANSWER - A form of distributed computing in which
client intelligence is moved to a middle tier so that stateless clients can be used.
Client-server architecture - CORRECT ANSWER - A form of distributed computing in
which client code contacts the server for data, then formats and displays it to the use. Input from
the client is committed back to the server when it represents a permanent change.
Cloud computing - CORRECT ANSWER - A computing model that enables convenient,
on-demand network access to a shared pool of configurable computing resources (e.g., networks,
servers, storage, applications, and services) that can be rapidly provisioned and released with
minimal management effort or service provider interaction.
Defense-in-depth - CORRECT ANSWER - A security principle in which multiple layers of
controls and risk-mitigation countermeasures are incorporated so that there is no single point of
complete compromise.
Discretionary Access Control - CORRECT ANSWER - A means of restricting access to
objects based on the identity of subjects and groups to which they belong. The controls are
discretionary in the sense that a subject with certain access permission is capable of passing that
permission on to another subject.
Economy of mechanism - CORRECT ANSWER - A security principle that states that the
more complex the design is, the more likelihood there is of vulnerabilities; keeping the software
design small and simple decreases attack surface and has fewer
weak links.
Enterprise service bus - CORRECT ANSWER - A software architecture model used for
designing and implementing the interaction and communication
