Practicing Domains 3 and 4: architecture, engineering and network security · CISSP-160 Lesson 6

Domains 3 and 4 together carry about 26 % of the exam in both the 2024 and 2027 outlines. They are the most technical part of the CISSP and the part that worries candidates from governance backgrounds most. Hannah's diagnostic put them at the top of her study list. The good news is that the exam tests understanding at the level of a security architect choosing among options, not the level of an engineer configuring a device. You need to know what each model, mechanism and protocol does, what it protects against and where its limits lie.

This lesson maps the two domains, highlights the distinctions that items most often turn on, and works through ten original practice items. As in lesson 5, try each item before reading the steps.

Domain 3 at a glance

Area	Ideas that appear often	Course that taught it
Secure design principles	Least privilege, defense in depth, secure defaults, fail securely, separation of duties, keep it simple, zero trust, privacy by design, shared responsibility	CISSP-112 lesson 1
Security models	Bell-LaPadula (confidentiality), Biba (integrity), Clark-Wilson (well-formed transactions), Brewer-Nash (conflicts of interest)	CISSP-112 lesson 2
Evaluation and certification	Common Criteria, protection profiles, evaluation assurance levels, authorization	CISSP-112 lesson 3
System architectures	Trusted computing base, reference monitor, virtualization, containers, cloud models, embedded and industrial systems, IoT	CISSP-112 lessons 4 to 6
Cryptography	Symmetric and asymmetric algorithms, hashing, digital signatures, PKI, key management, modes of operation, post-quantum migration	CISSP-112 lessons 7 to 9
Cryptanalytic attacks (concepts)	What brute force, birthday, side-channel and implementation weaknesses mean for design choices	CISSP-112 lesson 10
Site and facility design	Crime prevention through environmental design, power, fire suppression, environmental controls	CISSP-112 lessons 11 to 12

Cryptography items reward a clear table in your head of what each tool provides. Symmetric encryption provides confidentiality efficiently. Asymmetric encryption solves key distribution. Hashing provides integrity. A digital signature, made by hashing a message and encrypting the hash with the sender's private key, provides integrity, authentication of origin and non-repudiation. A message authentication code provides integrity and authentication but not non-repudiation, because both parties share the key.

What each cryptographic mechanism provides.
Mechanism	Confidentiality	Integrity	Authentication	Non-repudiation
Symmetric encryption	Yes	Only with an authenticated mode	Only with an authenticated mode	No
Asymmetric encryption (with recipient's public key)	Yes	No	No	No
Hash	No	Yes (detects change)	No	No
Message authentication code (HMAC)	No	Yes	Yes	No
Digital signature	No	Yes	Yes	Yes

Domain 4 at a glance

Area	Ideas that appear often	Course that taught it
Models and protocols	OSI and TCP/IP layers, where protocols and devices operate, encapsulation	CISSP-113 lessons 1 to 2
Secure protocols	TLS, IPsec (AH, ESP, transport and tunnel modes), SSH, DNSSEC, secure email	CISSP-113 lessons 3 to 5
Network architecture	Segmentation, DMZs, micro-segmentation, software-defined networks, zero trust network access	CISSP-113 lessons 6 to 7
Network components	Firewalls (packet filter, stateful, application, next-generation), proxies, IDS and IPS, NAC, load balancers	CISSP-113 lesson 8
Wireless and remote access	WPA3, enterprise authentication with 802.1X, VPNs, remote work	CISSP-113 lessons 9 to 10
Network attacks (concepts)	What denial of service, spoofing, on-path interception and DNS poisoning mean for design	CISSP-113 lesson 11

Domain 4 items often ask where something happens. Knowing the layer of each device and protocol settles many of them: switches at layer 2, routers at layer 3, packet-filtering firewalls at layers 3 and 4, application firewalls and proxies at layer 7, TLS between the transport and application layers in the TCP/IP model. Hannah drew the OSI model on a card with three devices and three protocols at each layer and reviewed it daily for two weeks.

The seven OSI layers stacked from physical at the bottom to application at the top, each with example devices and protocols beside it: hubs and cabling at layer 1, switches and 802.1X at layer 2, routers and IPsec at layer 3, TCP, UDP and stateful firewalls at layer 4, and application firewalls, DNS and HTTPS at layer 7. — Where devices and protocols sit in the OSI model.

Practice items: Domain 3

Worked problem

Item 1: choosing a model

A financial firm wants to stop an analyst who has advised one bank from seeing confidential data about a competing bank. Which security model BEST fits this requirement? (A) Bell-LaPadula. (B) Biba. (C) Brewer-Nash. (D) Clark-Wilson.

Show solution

Stem: preventing conflicts of interest based on what a user has already accessed.
Bell-LaPadula protects confidentiality by levels; Biba protects integrity by levels; Clark-Wilson enforces well-formed transactions and separation of duties.
Brewer-Nash, also called the Chinese Wall model, changes access dynamically based on prior access to prevent conflicts of interest.

Answer: C. Brewer-Nash prevents conflicts of interest by restricting access after a user has seen a competitor's data.

Worked problem

Item 2: proving who sent a message

Ridgeline needs partner banks to be able to prove, if challenged, that a payment instruction came from Ridgeline and was not altered. Which mechanism BEST provides this? (A) Encrypting the message with a shared symmetric key. (B) Hashing the message. (C) A digital signature using Ridgeline's private key. (D) An HMAC using a key shared with each bank.

Show solution

Stem: proof of origin and integrity that holds up if challenged, which is non-repudiation.
Symmetric encryption and HMAC use shared keys, so either party could have produced the message.
A hash alone detects change but does not identify the sender.
A digital signature made with a private key only Ridgeline holds provides integrity, authentication and non-repudiation.

Answer: C. Only a digital signature provides non-repudiation.

Worked problem

Item 3: planning for quantum computers

Ridgeline stores signed contracts that must remain verifiable for 15 years. The security architect is concerned about future quantum computers. What should be done FIRST? (A) Replace all algorithms with post-quantum ones immediately. (B) Build an inventory of where and how cryptography is used and plan a migration to standardized post-quantum algorithms. (C) Double all symmetric key lengths and take no other action. (D) Wait until quantum computers are commercially available.

Show solution

Stem: FIRST step in a post-quantum transition.
A is premature without knowing where cryptography is used; C helps symmetric algorithms but does nothing for the public-key signatures that quantum attacks threaten most; D ignores long-lived data.
B, a cryptographic inventory and migration plan to the standardized algorithms, is the first step that guidance from standards bodies recommends.

Answer: B. Inventory first, then plan a migration to standardized post-quantum algorithms, prioritizing long-lived data and signatures.

Worked problem

Item 4: what the reference monitor must be

Which property is NOT one of the requirements for a reference monitor? (A) It must be tamperproof. (B) It must always be invoked. (C) It must be small enough to be verified. (D) It must be implemented in hardware only.

Show solution

Stem: NOT a requirement.
Recall CISSP-112: the reference monitor concept requires complete mediation (always invoked), isolation (tamperproof) and verifiability (small and simple enough to analyze).
There is no requirement that it be hardware only; it is usually implemented by the security kernel in software and hardware together.

Answer: D. Hardware-only implementation is not a requirement.

Worked problem

Item 5: the data center fire

Ridgeline is designing a new server room that is normally unoccupied. Which fire suppression approach BEST protects the equipment while keeping people safe? (A) A wet-pipe sprinkler system. (B) A clean-agent gaseous system with alarms and a delay that lets anyone present leave. (C) Portable water extinguishers only. (D) No suppression, to avoid accidental discharge.

Show solution

Stem: BEST protects equipment while keeping people safe.
Wet-pipe sprinklers protect the building but damage electronics. Portable extinguishers alone are inadequate. No suppression is unacceptable.
A clean-agent system suppresses fire with little damage to equipment; the alarm and delay protect anyone present, honoring the life-safety priority.

Answer: B. A clean-agent system with pre-discharge alarm and delay; many designs also keep a pre-action sprinkler as a backup required by the building code.

Practice items: Domain 4

Worked problem

Item 6: where a control operates

A firewall rule allows traffic only when it belongs to a connection that the firewall has seen established from inside the network. What type of firewall is this? (A) Static packet filter. (B) Stateful inspection firewall. (C) Circuit-level proxy. (D) Web application firewall.

Show solution

Stem: decisions based on whether a packet belongs to an established connection.
A static packet filter examines each packet alone. A web application firewall inspects application requests. A circuit-level proxy relays sessions.
A stateful firewall tracks connection state and allows return traffic for established sessions.

Answer: B. Tracking connection state is the defining feature of stateful inspection.

Worked problem

Item 7: protecting traffic between data centers

Ridgeline wants to encrypt all traffic between its two data centers, including the original IP headers, over the public internet. Which approach is BEST? (A) IPsec in transport mode with AH only. (B) IPsec in tunnel mode with ESP. (C) TLS on each web application only. (D) SSH on every server.

Show solution

Stem: encrypt everything, including original headers, between sites.
AH provides integrity and authentication but no encryption. Transport mode protects the payload, not the original header.
TLS and SSH protect individual applications or sessions, not all traffic between sites.
IPsec tunnel mode with ESP encrypts the whole original packet inside a new one, which suits a site-to-site VPN.

Answer: B. IPsec tunnel mode with ESP encrypts entire packets between gateways.

Worked problem

Item 8: wireless in the office

Ridgeline's office Wi-Fi uses a single shared passphrase that has been given to hundreds of staff over the years. What is the BEST improvement? (A) Change the passphrase every month. (B) Move to WPA3-Enterprise with 802.1X authentication against the corporate directory. (C) Hide the network name. (D) Filter by device MAC address.

Show solution

Stem: BEST improvement to a shared-passphrase network.
Rotating a shared passphrase helps little and is hard to manage; hiding the network name and MAC filtering are easily defeated.
WPA3-Enterprise with 802.1X gives each user individual credentials, lets access be revoked per person and ties to existing identity controls.

Answer: B. Enterprise authentication with 802.1X replaces a shared secret with individual credentials.

Worked problem

Item 9: segmenting the network

Auditors find that Ridgeline's card-processing servers sit on the same flat network as staff laptops. What is the MOST effective way to reduce this risk? (A) Install antivirus on the laptops. (B) Segment the card environment into its own zone with tightly controlled access. (C) Encrypt the laptop drives. (D) Increase password length for staff.

Show solution

Stem: MOST effective way to reduce risk from a flat network.
A, C and D improve endpoint or account security but leave every laptop able to reach the card servers.
Segmentation limits who and what can reach the sensitive systems and reduces the scope of compliance obligations.

Answer: B. Segmentation contains the sensitive environment and reduces exposure.

Worked problem

Item 10: securing DNS responses

Ridgeline wants clients to be able to verify that answers about its domain names really come from its authoritative servers and have not been altered. What should it deploy? (A) DNS over HTTPS only. (B) DNSSEC. (C) A longer DNS cache time. (D) Split-horizon DNS.

Show solution

Stem: verify origin and integrity of DNS answers.
DNS over HTTPS encrypts the query between client and resolver but does not prove the answer came from the authoritative zone. Cache time and split-horizon do not provide verification.
DNSSEC signs DNS records so that resolvers can validate origin and integrity.

Answer: B. DNSSEC provides origin authentication and integrity for DNS data.

A quick check on key counts

One small calculation appears in Domain 3 items surprisingly often: how many keys a group needs. With symmetric cryptography, every pair needs its own key, so a group of n people needs \(n(n-1)/2\) keys. With asymmetric cryptography, each person needs one key pair, so the group needs \(2n\) keys in total. The program shows how quickly the symmetric number grows, which is why asymmetric cryptography is used for key exchange.

# Keys needed for n participants: symmetric (pairwise) vs asymmetric (one pair each)
for n in (5, 10, 50, 200):
    symmetric = n * (n - 1) // 2
    asymmetric = 2 * n
    print(f"n = {n:>3}: symmetric {symmetric:>6} keys, asymmetric {asymmetric:>4} keys ({n} pairs)")

Output

n =   5: symmetric     10 keys, asymmetric   10 keys (5 pairs)
n =  10: symmetric     45 keys, asymmetric   20 keys (10 pairs)
n =  50: symmetric   1225 keys, asymmetric  100 keys (50 pairs)
n = 200: symmetric  19900 keys, asymmetric  400 keys (200 pairs)

Patterns to remember

If the item asks...	The answer is usually...
Which mechanism provides non-repudiation	A digital signature
Which model prevents conflicts of interest	Brewer-Nash
Which model protects integrity ("no read down, no write up")	Biba
Which model protects confidentiality ("no read up, no write down")	Bell-LaPadula
How to encrypt all traffic between sites	IPsec tunnel mode with ESP
How to authenticate Wi-Fi users individually	WPA3-Enterprise with 802.1X
How to verify DNS answers	DNSSEC
The first step in a post-quantum transition	A cryptographic inventory and migration plan

Common mistakes

MistakeChoosing an HMAC when the item asks for non-repudiation.
InsteadShared-key mechanisms cannot prove which party created a message; use a digital signature.
MistakeMixing up Bell-LaPadula and Biba.
InsteadBell-LaPadula protects confidentiality; Biba protects integrity, with the rules reversed.
MistakeChoosing IPsec AH for confidentiality.
InsteadAH authenticates; ESP encrypts.
MistakeTreating DNS over HTTPS as a replacement for DNSSEC.
InsteadDoH protects privacy of queries; DNSSEC verifies the answers themselves.
MistakeAnswering every Domain 3 item from memory of algorithm details.
InsteadMost items ask which tool fits a requirement; start from what each tool provides.

Summary and key terms

Domains 3 and 4 carry about a quarter of the exam and test an architect's choice among mechanisms, not configuration detail.
Know what each cryptographic mechanism provides; only digital signatures provide non-repudiation.
Know the security models by purpose: Bell-LaPadula confidentiality, Biba integrity, Clark-Wilson transactions, Brewer-Nash conflicts of interest.
Place devices and protocols in the OSI model; many Domain 4 items ask where something happens.
Prefer segmentation, enterprise authentication and authenticated encryption over weaker shortcuts.
For post-quantum risk, start with a cryptographic inventory and a migration plan.

Non-repudiation: Assurance that the originator of a message cannot credibly deny having sent it.
Reference monitor: An abstract mechanism that mediates every access between subjects and objects, required to be always invoked, tamperproof and verifiable.
Encapsulating Security Payload (ESP): The IPsec protocol that provides confidentiality as well as integrity and authentication.
Stateful inspection: A firewall technique that tracks connection state and allows traffic belonging to established sessions.
DNSSEC: Extensions that sign DNS data so that resolvers can verify its origin and integrity.
Cryptographic inventory: A record of where and how an organization uses cryptographic algorithms, keys and certificates.

Practice problems

Work each problem on paper first, then reveal the answer to check.

Which mechanism provides integrity and authentication but not non-repudiation?
Show answer
A message authentication code such as HMAC.
Which model would stop a consultant from accessing a competitor's data after advising a client?
Show answer
Brewer-Nash.
At which OSI layer does a router make forwarding decisions?
Show answer
Layer 3, the network layer.
How many keys does a group of 10 need with symmetric cryptography, and how many with asymmetric?
Show answer
45 symmetric keys; 20 asymmetric keys (10 pairs).
Which IPsec mode encrypts the original IP header?
Show answer
Tunnel mode, with ESP.
What three properties must a reference monitor have?
Show answer
Always invoked, tamperproof and verifiable.