Security Architecture and Design
What this domain tests
The Security Architecture and Design domain tests whether you can place controls at the right trust boundaries and justify design decisions. Expect questions on defense in depth, least privilege, zero trust, segmentation, secure defaults, and fail-safe behavior.
Core rules and concepts
- Trust boundaries mark where data or identity crosses between components with different assurance. Authenticate and authorize at each boundary, not only at the edge.
- Defense in depth means independent, overlapping controls; a single WAF or VPN is not a strategy.
- Least privilege applies to users, services, and infrastructure identities. Use short-lived credentials and deny-by-default policy.
- Zero trust removes implicit network trust: verify explicitly, assume breach, and enforce least privilege per request.
- Secure defaults should fail closed for security decisions, log denials, and require deliberate change to weaken controls.
- Segmentation limits lateral movement; pair network policy with identity-aware access and monitoring.
- Crypto design requires vetted libraries, key rotation, separation of duties, and protection of keys outside application code.
Worked example
A three-tier web application has a public load balancer, an application tier, and a database tier. The design should place trust boundaries at the load balancer, between application and database, and at administrative access. Use mTLS or workload identity between tiers, deny-by-default network policy, a database account limited to required tables, and centralized audit logging. A shared flat network with one firewall is insufficient because compromise of the application tier would reach the database directly.
Traps that cost marks
Bolting security on after design; relying on a single control; assuming the perimeter is trustworthy; confusing authentication with authorization; and choosing fail-open behavior for access-control failures.
Exam-ready summary
Name the boundary, the identity, the control, and the failure mode.