Identify security architecture approach
Domain 2 tests whether you can select and tailor an architecture method rather than recite one. Questions ask which framework fits a context, what artifact each produces, and where threat modeling sits.
Frameworks and what they give you
SABSA is business-requirements-driven and layered: contextual, conceptual, logical, physical, component, giving traceability from business drivers to controls. TOGAF's ADM (Phases A-H) supplies an enterprise architecture lifecycle with security overlays in each phase. Zachman is a taxonomy (What, How, Where, Who, When, Why across planner to implementer), not a process. NIST SP 800-37 RMF has seven steps: Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor. Threat modeling methods include STRIDE (spoofing, tampering, repudiation, information disclosure, denial of service, elevation), PASTA (risk-centric), LINDDUN (privacy), and attack trees.
Selection criteria
Choose by regulatory rigor, existing EA investment, delivery model (agile vs waterfall), stakeholder views needed, and required traceability. Combine methods deliberately: an EA framework for structure, a threat model per system, and a control catalog for evidence. Zero trust (NIST SP 800-207) is an architecture pattern with policy decision and enforcement points, not a product.
Worked example
A payments firm must ship a new service in one quarter while satisfying PCI DSS v4.0 and SOX. The architect selects SABSA to trace business drivers to controls for PCI evidence, uses TOGAF ADM Phases B and C artifacts to align with the existing EA repository, runs STRIDE on the data-flow diagram before coding, and uses an RMF-style authorization before go-live. Reasoning: PCI needs documented traceability and SOX needs change evidence, so the method must produce both; a heavyweight framework alone would miss the delivery window, so it is tailored, not abandoned.
Traps
Framework dogmatism; calling Zachman a methodology; threat modeling after build; treating SABSA as a checklist; buying a product and calling it zero trust; tailoring without documenting the rationale.