CPSA Cross-cutting Concepts Questions and Answers — Questions and Answers
Question 1: An architect is designing a large-scale enterprise system with multiple services. The requirements state that every action that modifies data must be logged for auditing purposes, and every incoming request must be checked for valid authentication credentials. How are these two requirements best categorized?
- As core business logic for their respective services.
- As cross-cutting concepts that affect multiple services. (Correct answer)
- As deployment view concerns to be handled by infrastructure.
- As specific quality attributes tied to reliability.
Correct answer: As cross-cutting concepts that affect multiple services.
Authentication and audit logging are classic examples of cross-cutting concepts (or concerns) because their logic needs to be applied across many different modules or services in a system. [3, 4] They are not part of the core business logic of any single component (like calculating an order total) but are systemic, overarching functionalities. [3, 6] While they can be implemented in the infrastructure, their primary architectural classification is as cross-cutting concepts that require a deliberate design strategy.
Question 2: Which of the following is the most significant architectural risk of implementing cross-cutting concerns by duplicating the necessary code within every affected building block?
- A decrease in system performance due to code bloat.
- An increase in system complexity and severe maintenance challenges. (Correct answer)
- A violation of the single responsibility principle for each block.
- Difficulty in documenting the system's runtime view.
Correct answer: An increase in system complexity and severe maintenance challenges.
Duplicating code for concerns like logging or security across many components leads to 'scattering'. [3] This makes the system incredibly difficult to maintain; a single change to the concern (e.g., updating the logging format) requires finding and modifying every instance, which is error-prone and time-consuming. [3, 4] This maintenance overhead and increased complexity is the most significant architectural risk.
Question 3: Which of the following is LEAST likely to be considered a cross-cutting concept in software architecture?
- User account creation logic. (Correct answer)
- Transaction management.
- Security authorization checks.
- System-wide caching strategy.
Correct answer: User account creation logic.
User account creation is typically a specific piece of functional, or core, business logic encapsulated within a single module or service (e.g., an 'Identity' or 'User Management' service). [2] In contrast, transaction management, security checks, and caching are functionalities that often apply horizontally across many different modules and layers of an application, making them classic cross-cutting concerns. [3, 4]
Question 4: A development team is building a microservices-based application. To handle security, the architect decides that each service should not implement its own authentication and authorization logic. Instead, an API Gateway will intercept all incoming requests, validate credentials, and enrich request headers before forwarding them to the appropriate service. This approach is a strategy for what?
- Increasing the cohesion of each microservice.
- Centralizing the implementation of a cross-cutting concern. (Correct answer)
- Decoupling the system from specific infrastructure.
- Improving the observability of the runtime view.
Correct answer: Centralizing the implementation of a cross-cutting concern.
Security (authentication and authorization) is a cross-cutting concern. By handling it in a centralized component like an API Gateway, the architect avoids scattering the implementation across all microservices. [3, 6] This centralizes the logic, making it easier to manage, update, and ensure consistency, which is a key goal when designing for cross-cutting concerns. [4]
Question 5: According to the iSAQB curriculum, what is the primary purpose of defining and documenting cross-cutting concepts?
- To provide a complete component specification for third-party developers.
- To ensure the conceptual integrity and consistency of the architecture. (Correct answer)
- To map business requirements directly to building blocks.
- To satisfy legal and compliance requirements for auditing.
Correct answer: To ensure the conceptual integrity and consistency of the architecture.
Defining and documenting cross-cutting concepts helps ensure that overarching rules and decisions are applied consistently across the entire system. [7] This creates conceptual integrity (homogeneity), which is a critical factor in achieving the system's desired internal quality attributes, such as maintainability and reliability. [7, 8]
Question 6: An architect needs to introduce a performance monitoring mechanism. The goal is to measure and log the execution time of specific methods in the business and data access layers without modifying the source code of those methods. Which technology or programming paradigm is specifically designed to address this type of challenge?
- Containerization (e.g., Docker).
- Dependency Injection (DI).
- Aspect-Oriented Programming (AOP). (Correct answer)
- Service-Oriented Architecture (SOA).
Correct answer: Aspect-Oriented Programming (AOP).
Aspect-Oriented Programming (AOP) is a paradigm designed to modularize cross-cutting concerns. [3, 11] It allows an architect to define 'aspects' (e.g., logging, transaction management, performance monitoring) and declaratively apply them to specific points in the code (e.g., before or after a method executes) without altering the method's code itself. [11, 14] This perfectly matches the scenario's requirements.
CPSA Cross-cutting Concepts Questions and Answers
An architect is designing a large-scale enterprise system with multiple services.
The requirements state that every action that modifies data must be logged for auditing purposes, and every incoming request must be checked for valid authentication credentials.
How are these two requirements best categorized?