CISSP Domain 3 practice questions
Security Architecture and Engineering
Domain 3 is the broadest domain: secure design principles, security models, cryptography, and physical security. You need enough cryptography to choose the right primitive for a requirement, and enough architecture to recognise when a design violates least privilege, defence in depth or fail-secure behaviour.
Sample Domain 3 questions
A sender wants recipients to verify that a message came from them and was not altered. What should the sender use?
A consultancy must prevent analysts who work for one bank from accessing data of a competing bank. Which model addresses this?
A data centre door controller loses power. Staff safety is the priority. How should the door behave?
Common Domain 3 traps
- Mixing up Bell-LaPadula (confidentiality, no read up / no write down) and Biba (integrity, no read down / no write up).
- Using hashing where confidentiality is required, or encryption where integrity proof is required.
- Forgetting that digital signatures use the sender's private key.
Key concepts to master
- Secure design principles: least privilege, zero trust, secure defaults
- Security models: Bell-LaPadula, Biba, Clark-Wilson, Brewer-Nash
- Symmetric vs asymmetric cryptography, hashing, PKI
- Cryptanalytic attacks and key management
- Site and facility design, fire suppression
Need the theory first? Read the CISSP Domain 3 study guide.
Find out where you stand
Start with the free 10-question CISSP practice test — no signup. Then create a free account for Practice Mode, or go Pro for Domain Quick-Fire, CAT-style adaptive exams and readiness analytics.