CPSA Cross-cutting Concepts Questions and Answers

Question 1

An architect is designing a large-scale enterprise system with multiple services. The requirements state that every action that modifies data must be logged for auditing purposes, and every incoming request must be checked for valid authentication credentials. How are these two requirements best categorized?

Accepted Answer

As cross-cutting concepts that affect multiple services.

Answer

Authentication and audit logging are classic examples of cross-cutting concepts (or concerns) because their logic needs to be applied across many different modules or services in a system. [3, 4] They are not part of the core business logic of any single component (like calculating an order total) but are systemic, overarching functionalities. [3, 6] While they can be implemented in the infrastructure, their primary architectural classification is as cross-cutting concepts that require a deliberate design strategy.

Question 2

Which of the following is the most significant architectural risk of implementing cross-cutting concerns by duplicating the necessary code within every affected building block?

Accepted Answer

An increase in system complexity and severe maintenance challenges.

Answer

Duplicating code for concerns like logging or security across many components leads to 'scattering'. [3] This makes the system incredibly difficult to maintain; a single change to the concern (e.g., updating the logging format) requires finding and modifying every instance, which is error-prone and time-consuming. [3, 4] This maintenance overhead and increased complexity is the most significant architectural risk.

Question 3

Which of the following is LEAST likely to be considered a cross-cutting concept in software architecture?

Accepted Answer

User account creation logic.

Answer

User account creation is typically a specific piece of functional, or core, business logic encapsulated within a single module or service (e.g., an 'Identity' or 'User Management' service). [2] In contrast, transaction management, security checks, and caching are functionalities that often apply horizontally across many different modules and layers of an application, making them classic cross-cutting concerns. [3, 4]

Question 4

A development team is building a microservices-based application. To handle security, the architect decides that each service should not implement its own authentication and authorization logic. Instead, an API Gateway will intercept all incoming requests, validate credentials, and enrich request headers before forwarding them to the appropriate service. This approach is a strategy for what?

Accepted Answer

Centralizing the implementation of a cross-cutting concern.

Answer

Security (authentication and authorization) is a cross-cutting concern. By handling it in a centralized component like an API Gateway, the architect avoids scattering the implementation across all microservices. [3, 6] This centralizes the logic, making it easier to manage, update, and ensure consistency, which is a key goal when designing for cross-cutting concerns. [4]

Question 5

According to the iSAQB curriculum, what is the primary purpose of defining and documenting cross-cutting concepts?

Accepted Answer

To ensure the conceptual integrity and consistency of the architecture.

Answer

Defining and documenting cross-cutting concepts helps ensure that overarching rules and decisions are applied consistently across the entire system. [7] This creates conceptual integrity (homogeneity), which is a critical factor in achieving the system's desired internal quality attributes, such as maintainability and reliability. [7, 8]

CPSA Exam Practice Test

CPSA Exam Practice Test

CPSA Cross-cutting Concepts Questions and Answers