Security Architecture and Design
Security Architecture and Design tests whether you can choose controls that hold together as a system, not just a list of products. GCT-2A-324 expects fluency with defense in depth, least privilege, trust boundaries, reference monitors, security models, segmentation, and threat modeling. The exam rewards designs that fail safely and can be explained from data flow to control.
Core rules and concepts
- Defense in depth layers preventive, detective, and corrective controls so one failure does not expose the asset. It is not “buy more tools.”
- Least privilege, separation of duties, complete mediation, fail-safe defaults, and least common mechanism are design principles. A reference monitor must be tamper-resistant, always invoked, and small enough to verify; it is part of the trusted computing base.
- Bell-LaPadula protects confidentiality: no read up, no write down. Biba protects integrity: no read down, no write up. Clark-Wilson uses well-formed transactions and separation of duty rather than lattice labels.
- Trust boundaries belong on data-flow diagrams. STRIDE (spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege) turns each boundary into concrete threats.
- Zero trust replaces implicit network trust with explicit, per-request verification, least-privilege access, and assume-breach monitoring.
Worked example
A three-tier web application has a public load balancer, an application tier, and a database tier. The design puts the load balancer and WAF in a public subnet, the application tier in a private subnet, and the database in an isolated subnet with no internet route. The application reaches the database only over a restricted port using a dedicated service identity. Threat modeling at the public boundary identifies spoofing and tampering; the team adds TLS with certificate validation, input validation, and centralized logging. At the application-to-database boundary, information disclosure is the main threat, so encryption in transit and least-privilege database roles are required. The reasoning: each control answers a named threat at a named boundary.
Traps that cost marks
- Assuming the cloud provider secures customer data, identities, and configurations.
- Mixing Bell-LaPadula and Biba directions under time pressure.
- Counting products as defense in depth without coverage of a threat.
- Drawing a logical architecture with no trust boundaries or data flows.