CPSA Cross-cutting Concepts 5 — Questions and Answers
Question 1: Which cross-cutting concern category includes audit logging, performance metrics collection, and health check endpoints?
- Observability (Correct answer)
- Security
- Scalability
- Reliability
Correct answer: Observability
Audit logs, metrics, and health checks all belong to observability — the cross-cutting concern of making a system's internal state and history visible to operators.
Question 2: A software architect proposes using a shared exception hierarchy and a common error-handling framework. This addresses which architectural quality?
- Consistency and maintainability across the codebase (Correct answer)
- Performance at the hardware level
- Scalability of the data store
- Portability to different cloud providers
Correct answer: Consistency and maintainability across the codebase
A common exception hierarchy and error-handling framework reduce divergent error-handling patterns, improving consistency and long-term maintainability.
Question 3: In a CPSA context, which technique decouples a cross-cutting concern from business logic by using declarative metadata (e.g., annotations)?
- Decorator / annotation-driven programming (Correct answer)
- Hard-coded conditional logic within business methods
- Direct framework API calls inside domain classes
- SQL triggers on the database
Correct answer: Decorator / annotation-driven programming
Annotation-driven decoration lets frameworks apply cross-cutting behavior (e.g., @Transactional, @Cacheable) without embedding that logic inside the business class itself.
Question 4: Which cross-cutting strategy reduces the blast radius of a misconfigured or compromised service in a microservices system?
- Principle of least privilege applied to service-to-service permissions (Correct answer)
- Shared database credentials for all services
- Single API key for all inter-service calls
- Disabling network segmentation for easier debugging
Correct answer: Principle of least privilege applied to service-to-service permissions
Least-privilege permissions limit what a compromised service can access, containing the damage to only the resources that service legitimately needs.
Question 5: A CPSA architect is asked to ensure repeatable, deterministic deployments across all environments. Which cross-cutting practice best achieves this?
- Immutable infrastructure combined with infrastructure-as-code (Correct answer)
- Manual configuration applied by operations teams per environment
- Direct SSH changes to production servers to fix drift
- Sharing a single long-lived server across all environments
Correct answer: Immutable infrastructure combined with infrastructure-as-code
Immutable infrastructure with infrastructure-as-code ensures every environment is provisioned identically from version-controlled definitions, eliminating configuration drift.
Question 6: Which cross-cutting mechanism prevents a slow database query from degrading the responsiveness of unrelated read operations in the same service?
- Bulkhead pattern using separate thread pools or connection pools (Correct answer)
- Increasing the global connection pool size
- Switching all queries to synchronous processing
- Combining read and write operations into a single query
Correct answer: Bulkhead pattern using separate thread pools or connection pools
The bulkhead pattern isolates resources (threads or connections) for different operation types so that saturation in one pool does not starve another.
Question 7: When enforcing secure secret management as a cross-cutting concern, which practice is considered a baseline requirement by CPSA and modern security frameworks?
- Storing secrets in a dedicated secrets manager and injecting them at runtime, never in source code (Correct answer)
- Committing encrypted secrets directly to the version control repository
- Hardcoding secrets as constants in configuration files checked into git
- Sharing a single secret across all services for simplicity
Correct answer: Storing secrets in a dedicated secrets manager and injecting them at runtime, never in source code
Secrets managers (e.g., HashiCorp Vault, AWS Secrets Manager) centralize secret storage and inject values at runtime, preventing secrets from appearing in source control.
CPSA Cross-cutting Concepts 5
Which cross-cutting concern category includes audit logging, performance metrics collection, and health check endpoints?