CISSP Exam Prep · Domain 3

Security Architecture & Engineering

Domain 3 covers secure design principles, security models, cryptography, PKI, and physical security. Expect heavy crypto math and model questions on the exam.

13% of exam weight 6 Lessons 30 Practice Questions

Exam Strategy Domain 3 is heavily tested with scenario-based questions. Cryptography (especially AES modes, key types, and digital signatures) and security models (BLP vs. Biba) are frequent trap areas. Read every question carefully for which property (confidentiality vs. integrity) is being protected.

Lessons

01 Design Principles & Zero Trust

8 secure design principles, Kerckhoffs's Principle, Zero Trust Architecture. Anchored to Platform C's defense-in-depth stack and the PII incident.

Least Privilege Zero Trust Fail-Safe Defaults

02 Security Models: BLP, Biba & Clark-Wilson

Bell-LaPadula (confidentiality), Biba (integrity), Clark-Wilson (commercial integrity), Brewer-Nash (conflict of interest).

Bell-LaPadula Biba Clark-Wilson

03 Cryptography Fundamentals

Symmetric (AES modes), asymmetric (RSA, ECC), hashing (SHA-256, HMAC), hybrid encryption. Quantum threats. Platform C crypto audit.

AES-256-CTR RSA HMAC

04 PKI, Certificates & Key Management

PKI hierarchy, CRL vs. OCSP, HSM, TPM, Vault key management, key lifecycle, certificate pinning. Platform C JWT key rotation.

PKI OCSP HSM

05 Virtualization, Cloud & Container Security

Hypervisor types, VM escape, shared responsibility model, Kubernetes security (RBAC, NetworkPolicy, PSS). Platform C on GCP.

Kubernetes Shared Responsibility VM Escape

06 Physical Security & Environmental Controls

Physical access layers, CPTED, mantraps, fire suppression systems, temperature/humidity, UPS. Manila data center planning.

Mantrap Pre-action FM-200

Domain 3 at a Glance

Lesson	Core Topic	Key Models / Standards	TS Relevance
01	Secure Design Principles	8 Principles, Zero Trust (ZTA)	PII incident root cause, Platform C arch
02	Security Models	BLP, Biba, Clark-Wilson, Brewer-Nash	Credit scoring integrity, loan workflows
03	Cryptography	AES, RSA, ECC, SHA-256, HMAC	AES-256-CTR PII, JWT RSA, TLS 1.3
04	PKI & Key Management	X.509, CRL, OCSP, FIPS 140-2	Vault, cert-manager, key rotation
05	Virtualization & Cloud	IaaS/PaaS/SaaS, K8s security	GKE, NetworkPolicies, Trivy scanning
06	Physical Security	CPTED, fire suppression, HVAC	Manila data center (Partner E)

Study Plan Start with Lesson 01 (design principles) to build mental models, then tackle Lesson 03 (cryptography) which carries the most exam weight. Security models (Lesson 02) are pure memorization — use the BLP/Biba rule table. Return to Lessons 04-06 for applied architecture questions.

← Master Index Start Lesson 01 →