ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question

Stress testing pushes a system beyond its expected capacity to observe how it fails. A secure design should fail in a controlled, "fail-closed" manner that preserves confidentiality, integrity, and availability. Returning HTTP 429 (Too Many Requests) responses once the transaction threshold is exceeded shows the rate-limiting logic is correctly throttling excess calls and preventing uncontrolled resource exhaustion. Because requests are explicitly denied and resources remain stable, the system avoids crashes or unhandled exceptions that could expose data or disrupt service. Continuing to process all traffic with slow responses, crashing from out-of-memory errors, or throwing unhandled database exceptions all indicate uncontrolled failure modes, not secure handling of stress conditions.