CPSA Cross-cutting Concepts 4 — Questions and Answers
Question 1: A CPSA architect documents that all services must emit metrics in the Prometheus exposition format. This is an example of enforcing which type of cross-cutting decision?
- Observability standard (Correct answer)
- Domain model constraint
- Deployment topology
- Data ownership boundary
Correct answer: Observability standard
Mandating a common metrics format is an observability standard — a cross-cutting decision that ensures all services are uniformly monitorable.
Question 2: Which technique most effectively prevents SQL injection as a cross-cutting security concern in a data access layer?
- Parameterized queries / prepared statements enforced in a shared data access library (Correct answer)
- Input length limits at the UI layer only
- Encrypting all database columns
- Running the database as a read-only replica
Correct answer: Parameterized queries / prepared statements enforced in a shared data access library
Parameterized queries separate SQL code from data, eliminating injection risk when enforced centrally in a shared data access library across all services.
Question 3: In CPSA, Aspect-Oriented Programming (AOP) is most directly associated with implementing which type of concern?
- Cross-cutting concerns such as logging and security (Correct answer)
- Core domain business logic
- Database schema migrations
- UI rendering pipelines
Correct answer: Cross-cutting concerns such as logging and security
AOP was specifically designed to modularize cross-cutting concerns like logging, security, and transaction management that would otherwise be scattered throughout the codebase.
Question 4: Which cross-cutting practice ensures that a system can reconstruct its state after a failure by replaying events?
- Event sourcing (Correct answer)
- CQRS read model projection
- Saga orchestration
- Database connection pooling
Correct answer: Event sourcing
Event sourcing stores every state change as an immutable event, allowing the system to replay events to reconstruct any past or current state after a failure.
Question 5: A team standardizes all inter-service timeouts to 500ms via a shared client library. Which cross-cutting quality attribute does this primarily protect?
- Resilience, by preventing resource exhaustion from slow dependencies (Correct answer)
- Throughput, by increasing the number of simultaneous requests
- Maintainability, by reducing code duplication
- Portability, by abstracting infrastructure details
Correct answer: Resilience, by preventing resource exhaustion from slow dependencies
Standardized timeouts prevent threads from blocking indefinitely on slow services, protecting system resilience by releasing resources promptly.
Question 6: Which cross-cutting architectural decision governs how personal data is anonymized or deleted across all services when a user invokes GDPR right-to-erasure?
- A data lifecycle policy enforced by a central privacy service or event (Correct answer)
- Letting each service independently decide when to delete data
- Storing all personal data in a single shared table
- Disabling data replication to reduce copies
Correct answer: A data lifecycle policy enforced by a central privacy service or event
A centrally enforced data lifecycle policy ensures consistent, auditable erasure across all services when a user's right-to-erasure request is processed.
Question 7: When implementing rate limiting as a cross-cutting concern in an API gateway, what is the most important state-sharing consideration for a horizontally scaled gateway?
- Rate limit counters must be stored in a shared external store (e.g., Redis) so all instances see the same count (Correct answer)
- Each gateway instance should maintain its own independent counter
- Rate limits should only be applied at the application service level
- Counters should be persisted in the relational database for durability
Correct answer: Rate limit counters must be stored in a shared external store (e.g., Redis) so all instances see the same count
Without a shared counter store, each gateway instance tracks limits independently, allowing clients to exceed the total rate limit by routing to different instances.
CPSA Cross-cutting Concepts 4
A CPSA architect documents that all services must emit metrics in the Prometheus exposition format.
This is an example of enforcing which type of cross-cutting decision?