OutSystems Security Specialist study plan

Map each of the five exam domains to the specific OutSystems Platform components it touches (Users app, Service Center, LifeTime, module-level roles, integrations, and environment configuration) so you can locate the relevant setting for any question.

Configure a free OutSystems personal environment and create at least three test users in the Users application, assigning them different roles so you can observe how role membership changes what each user sees.

Explain in writing the difference between built-in platform roles and custom module roles, and describe how end-user authentication differs from back-end service authentication in a single-tier versus multi-tier setup.

List the authentication methods available for end-user and service access (native platform login, external identity providers via SAML/OIDC-style federation, and service-account style integrations) and note for each one where it is configured.

Configure an external identity provider connection in your personal environment and walk through a successful login, capturing each configuration field and what it controls.

Break the login flow into its ordered steps (redirect to provider, assertion or token validation, user matching or provisioning, session creation) and write them out so you can predict what fails when one step is misconfigured.

Test at least four failure scenarios (wrong client secret, mismatched assertion audience, unknown user, expired assertion) and record the error surfaced to the user versus the detail logged for the administrator.

Describe how session timeout, remember-me behavior, and logout propagation are configured and what happens to an active session when the identity provider ends it.

Design a role model for a sample application with at least four roles and document the principle of least privilege applied to each screen, action, and server action.

Implement screen-level and action-level role checks in a test module and verify by logging in as each test user that unauthorized access is denied rather than merely hidden.

Distinguish between UI-level hiding of elements and server-side enforcement, and demonstrate why client-side checks alone are insufficient by calling a server action directly.

Apply entity-level restrictions so that a user in one role cannot read records belonging to another role's scope, and verify with test data spanning two tenants or departments.

Audit your sample module for missing permission checks on every exposed screen and server action, and remediate each gap found.

Explain how role assignment is administered in LifeTime versus the Users app and who can grant elevated roles, then restrict administrative access in your environment accordingly.

Identify insecure direct object reference risks in your screens and fix them by validating that the requesting user is entitled to the specific record, not just the screen.

Document a review checklist for authorization that you would apply to any new module before deployment.

Enumerate every network path in a deployed OutSystems application (browser to front-end, front-end to back-end, application to database, application to external APIs) and state which ones must be encrypted and why.

Configure HTTPS enforcement and HSTS-style redirect behavior in your environment and verify with browser developer tools that no request downgrades to plain HTTP.

Inspect the security headers and cookie attributes (Secure, HttpOnly, SameSite) on responses from your application and adjust platform or application settings to correct any weakness.

Describe how certificates are provisioned and renewed for published applications and what happens to clients when a certificate expires or is misconfigured.

Classify the data in your sample application into public, internal, confidential, and restricted tiers, and justify each classification in writing.

Apply encryption at rest for the restricted tier using platform-supported mechanisms, and document where keys are held and who can access them.

Configure input validation and output encoding on every form and list that displays user-supplied content, then attempt at least three injection-style payloads and confirm they are neutralized.

Explain how secrets such as API keys and connection strings are stored and referenced in OutSystems, and remove any hard-coded secret from your sample module.

Implement logging of security-relevant events (successful and failed logins, permission denials, sensitive record access) while ensuring sensitive values are never written to logs.

Apply data minimization and retention rules to your sample module, including what is persisted, for how long, and how deletion is performed.

Review the platform's built-in security configuration options and hardening recommendations, and apply at least five that are relevant to a production deployment.

Document a secure development lifecycle checklist covering code review, dependency review, and pre-deployment security verification.

Re-derive the key facts for each domain from your own notes without consulting references, then check your answers and record every gap.

Complete a timed 60-question mixed practice set weighted 20 percent per domain and review every incorrect answer to its root cause.

Revisit your weakest two domains by rebuilding the relevant configuration from scratch in a fresh module to confirm retention.

Write a one-page pre-exam summary of the decisions, defaults, and trade-offs you are most likely to confuse under time pressure.