Security Architecture & Engineering is one of the most technically dense domains on the CISSP exam, accounting for roughly 13% of your questions. It rewards conceptual understanding over memorization: the exam wants to know that you can apply secure design principles, not just recite them. This guide breaks Domain 3 into the areas that matter most and how they tend to be tested.
1. Secure design principles
Expect scenario questions that ask you to pick the principle being violated or applied. Know these cold: defense in depth, least privilege, separation of duties, fail-secure vs. fail-open, complete mediation, least common mechanism, psychological acceptability, and secure defaults. The exam loves “privacy by design” and “security by design” framed as choices made early in the SDLC rather than bolted on later.
2. Security models
Security models are the classic Domain 3 trap because they sound similar. Anchor each to its core purpose:
- Bell-LaPadula — confidentiality. “No read up, no write down.”
- Biba — integrity. “No write up, no read down” (the inverse of Bell-LaPadula).
- Clark-Wilson — integrity via well-formed transactions and separation of duties.
- Brewer-Nash (Chinese Wall) — prevents conflicts of interest based on access history.
A reliable exam tactic: if the question is about keeping secrets, think confidentiality (Bell-LaPadula); if it’s about preventing improper changes, think integrity (Biba, Clark-Wilson).
3. Cryptography
Cryptography is heavily represented. Distinguish symmetric (fast, shared key — AES, ChaCha20) from asymmetric (key exchange and digital signatures — RSA, ECC). Know that hashing provides integrity (SHA-2, SHA-3), digital signatures provide integrity plus non-repudiation, and that a PKI binds identities to public keys through certificate authorities. Be ready for cryptanalytic attacks: known-plaintext, chosen-ciphertext, birthday, side-channel, and downgrade attacks.
4. Vulnerabilities in system architectures
The exam tests your awareness of where weaknesses live: client-based (mobile code), server-based, database (aggregation and inference), cryptographic systems, industrial control systems (ICS/SCADA), cloud, IoT, containers, and serverless. You don’t need deep exploitation knowledge — you need to recognize the dominant risk for each architecture and the appropriate mitigating control.
5. Physical & facility security
Don’t neglect the physical side. Know fire suppression classes, the life-safety priority (people first, always), HVAC and humidity ranges, and the difference between mantraps, bollards, and CPTED principles. These are often quick wins on exam day.
How to study Domain 3 efficiently
Domain 3 is best learned through repetition on exam-style questions, because the format trains you to spot the “best” answer among several plausible ones. Read the explanation for every question — even the ones you get right — to reinforce why the distractors are wrong.