CPSA Cheat Sheet 2026

The 30 highest-yield CPSA facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. Which endorsement added to a homeowners policy would cover jewelry, furs, and fine arts on an open-perils, agreed-value basis? → Scheduled personal property endorsement
2. Which of the following is a valid output artifact from an ATAM evaluation? → Prioritized risk themes
3. A software architect proposes using a shared exception hierarchy and a common error-handling framework. This addresses which architectural quality? → Consistency and maintainability across the codebase
4. When applying the Dependency Inversion Principle to building blocks, high-level modules should: → Depend on abstractions rather than concrete low-level implementations
5. What is the primary purpose of defining scope before a CREST penetration test engagement? → To legally and operationally bound the systems the tester is authorized to target
6. In the arc42 template, which section specifically addresses quality scenarios and measurable quality goals? → Section 10 – Quality Requirements
7. Which factor most often leads to poor architectural decisions being made? → Incomplete understanding of quality attribute requirements and stakeholder priorities
8. Which cross-cutting strategy reduces the blast radius of a misconfigured or compromised service in a microservices system? → Principle of least privilege applied to service-to-service permissions
9. When evaluating architectural patterns, which ISO 25010 quality attribute does CQRS most directly improve for the read side? → Performance efficiency (scalability of reads)
10. Which of the following best defines 'architecture erosion' as a concern in evaluation? → The divergence between intended architecture and actual implemented architecture
11. Which design principle states that a class should have only one reason to change? → Single Responsibility Principle
12. In the C4 model, which level would you use to show a high-level overview suitable for non-technical executive stakeholders? → Level 1 – System Context
13. What is the primary defense against Cross-Site Request Forgery (CSRF) attacks in web applications? → Synchronizer token pattern using unpredictable CSRF tokens
14. Which of the following is a correct statement about high-reliability organizations (HROs) in healthcare? → They maintain a preoccupation with failure and sensitivity to operations
15. In CPSA, Aspect-Oriented Programming (AOP) is most directly associated with implementing which type of concern? → Cross-cutting concerns such as logging and security
16. Which Kruchten 4+1 view captures the concurrency and process communication aspects of a system? → Process view
17. Which statement BEST describes the Open/Closed Principle? → Software entities should be open for extension but closed for modification
18. An architecture evaluation finds that using a shared database between two services improves performance but reduces modifiability. This is an example of a: → Tradeoff point
19. Which integration style uses a central hub to route messages between multiple systems? → Message broker / hub-and-spoke integration
20. Which stakeholder concern is most critical to capture before making a major architectural decision? → Conflicting quality attribute priorities among different stakeholder groups
21. A startup requires rapid feature delivery, accepting more technical debt. How does this business constraint affect architectural decisions? → It favors simpler, less modular designs that speed delivery over long-term maintainability
22. Which protocol commonly uses Port 21 for its default communication? → FTP
23. A team adopts a 'Modular Monolith' instead of microservices. What is the primary architectural benefit of this choice? → Strong module boundaries with simpler deployment and operations than distributed services
24. Which quality attribute is MOST directly threatened when a system has tightly coupled components with no clear interfaces? → Maintainability
25. A system must process large volumes of financial transactions in strict sequential order. Which architectural style is most appropriate? → Pipe-and-Filter with sequential filters
26. What is the primary purpose of Mimikatz during a Windows penetration test? → Extracting plaintext passwords and hashes from Windows memory (LSASS)
27. What is the primary purpose of an Architecture Decision Record (ADR)? → To document the context, decision, and consequences of a significant architectural choice
28. When applying the hierarchy of controls to patient safety, which intervention is MOST effective? → Elimination of the hazard from the system
29. Under a claims-made liability policy, what is a 'retroactive date'? → The earliest date from which a covered incident can arise for the claim to be covered
30. The National Patient Safety Goals (NPSGs) are published annually by which organization? → The Joint Commission (TJC)