Security Architecture
Design principles
The architecture domain tests whether you can reason about structure rather than configuration. Core principles: least privilege, defense in depth, separation of duties, fail-safe defaults, complete mediation, economy of mechanism, open design (Kerckhoffs's principle), least common mechanism, and psychological acceptability. Zero trust extends these: no implicit trust based on network location, authenticate and authorize every request, assume breach.
Formal models
Memorize the direction of each rule because exams reverse them.
- Bell-LaPadula - confidentiality: no read up, no write down (the star property).
- Biba - integrity: no read down, no write up.
- Clark-Wilson - integrity through well-formed transactions and separation of duty.
- Brewer-Nash (Chinese Wall) - conflict of interest, dynamic access classes.
- Graham-Denning / Harrison-Ruzzo-Ullman - access matrix and rights propagation.
Trust boundaries and layering
Understand the reference monitor and trusted computing base, kernel vs. user mode, Type 1 vs. Type 2 hypervisors, and why containers share the host kernel and therefore isolate less strongly than virtual machines. Network architecture: DMZ, segmentation and microsegmentation, SD-WAN, SASE, and the cloud shared responsibility model (provider secures the cloud; you secure what is in it).
Traps
Confusing architecture (design decisions, models, boundaries) with engineering (implementation detail). Assuming a firewall disappears under zero trust - it does not; policy just stops being location-based. Treating the hypervisor as untrusted guest code.
Worked example
A user cleared to Confidential requests a Secret record. Bell-LaPadula's no-read-up rule denies it. The same user tries to write a Secret-labeled file into a Confidential store - no-write-down denies that too. If the requirement were data integrity instead, you would be in Biba's territory and the rules invert.