Official (ISC)² CSSLP - Domain 3: Secure Software Design questions with correct answers

3-Tier architecture Correct Answer-A form of distributed computing in which client intelligence is moved to a middle tier so that stateless clients can be used. Client-server architecture Correct Answer-A form of distributed computing in which client code contacts the server for data, then formats and displays it to the use. Input from the client is committed back to the server when it represents a permanent change. Cloud computing Correct Answer-A computing model that enables convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. Defense-in-depth Correct Answer-A security principle in which multiple layers of controls and risk-mitigation countermeasures are incorporated so that there is no single point of complete compromise. Discretionary Access Control Correct Answer-A means of restricting access to objects based on the identity of subjects and groups to which they belong. The controls are discretionary in the sense that a subject with certain access permission is capable of passing that permission on to another subject. Economy of mechanism Correct Answer-A security principle that states that the more complex the design is, the more likelihood there is of vulnerabilities; keeping the software design small and simple decreases attack surface and has fewer weak links.