Security Design Principles and Architecture Models

The door is not the design

Two companies move into identical buildings. The first company buys the most expensive vault door on the market, mounts it on the only entrance, and hires a guard to stand in front of it. The second company takes the same budget and spends it differently: it puts the lobby away from the offices, keeps the server room off the main corridor, gives the loading dock its own entrance with its own lock, puts windows only where nobody keeps secrets, and adds the vault door as the last layer rather than the only one. The first building is hard to enter and impossible to defend once someone gets in. The second is harder to think about, which is exactly why it is harder to break into. The difference between the two companies is not the equipment. It is the architecture: the decisions about where trust is assumed, where data crosses from one zone into another, and what happens when any single control fails.

That difference is the subject of this chapter, and it is the core of Domain 3, Security Architecture and Engineering. The domain is the most technical one on the exam, but its opening material is not about specific products or exploits. It is about the ideas that decide where controls go and how they behave under stress: the design principles that have governed secure system building since the 1970s, the trust boundary as the unit of architectural reasoning, the reference monitor and the trusted computing base as the theory of how access decisions are made, the architecture models from protection rings to the security modes of operation, and finally the Zero Trust model that NIST codified in Special Publication 800-207, which inverts the perimeter assumptions every earlier model took for granted.

The design principles

In July 1974, Jerome Saltzer and Michael Schroeder published “The Protection of Information in Computer Systems” in the Communications of the ACM. The paper is one of the founding documents of security engineering, and its eight design principles remain the most compact summary in the field of what makes a protection mechanism worth building. Every one of them shows up on the exam, usually as a scenario whose correct answer is the principle the scenario embodies or violates. The candidate who can name all eight and state each one in a sentence owns the section.

Economy of mechanism is the first principle: keep the design as simple and small as possible. Complexity is where bugs are born, and a protection mechanism with a large attack surface and tangled state transitions is one whose failure modes cannot be enumerated. Saltzer and Schroeder’s own phrasing is that simplicity and smallness are decisive factors in achieving anything like assurance. The exam version of this question offers a byzantine access-control module with hundreds of interacting features and asks which principle argues for replacing it, or offers a small, auditable kernel and asks why it is preferred. The answer is economy of mechanism, and the managerial point is that auditability is a security property: a mechanism that can be fully analyzed is a mechanism that can be trusted.

Fail-safe defaults is the second principle: base access decisions on explicit permission rather than on the absence of explicit denial. The default posture of any control must be denial, so that the failure case, the forgotten case, and the misconfigured case all land in the same place, the locked position. A system that grants access to everything unless an administrator has explicitly blocked it has inverted the principle: every new object, new user, or new integration inherits permission until someone thinks to revoke it, and someone never does. The principle’s companion in modern practice is secure defaults: ship systems in their safest configuration, so that hardening is the act of removing protections rather than the act of adding them. NIST SP 800-53 Revision 5 expresses the operational version in control CM-7, least functionality, which requires the system to provide only essential capabilities and to prohibit or restrict the functions, ports, protocols, and services that are not needed. Least functionality is fail-safe defaults applied to features.

Complete mediation is the third principle: every access to every protected object must be checked against the authorization policy every time, with no shortcut, no cache, and no privileged back door. The classic failure is the check that happens once at login and never again, or the kernel routine that bypasses the access checker because the caller is “trusted”. Time-of-check to time-of-use, TOCTOU, is the race that complete mediation exists to prevent: the moment between verifying a condition and acting on it, when an attacker can change the state the check relied on. A file’s ownership is checked, and then the file is swapped before it is opened. The defense is not a faster check; it is an operation in which the check and the use are the same atomic step, which is why complete mediation is listed as an explicit requirement of the reference monitor discussed later in this chapter.

Open design is the fourth principle: the security of the mechanism must not depend on the secrecy of its design. Protection should rest on secret keys and passwords, which can be changed, and never on secret algorithms or secret code paths, which once exposed are compromised forever. The principle is the theoretical foundation of public cryptography, where the algorithms are published and analyzed by the whole world and only the keys are secret. The exam tests it in two directions: the answer that proposes “security through obscurity”, hiding a flaw in an undocumented feature, is the violation, and the answer that relies on a widely reviewed, publicly specified protocol is the compliance. A candidate who remembers that Kerckhoffs stated the same principle for cryptography in 1883 can connect this chapter to the cryptography chapter that follows.

Separation of privilege is the fifth principle: require two independent conditions, or two independent parties, before a sensitive action is performed. The classic example is a system in which a critical operation requires two different keys held by two different people, so that no single compromised individual, and no single compromised key, is sufficient. Separation of privilege is the mechanism-level cousin of separation of duties in the governance domain: separation of duties divides responsibility so that no one person controls an entire process, and separation of privilege makes the system enforce that division mechanically. The exam scenario is the funds transfer that requires approval from two managers, or the root operation that requires both a password and a physical token, and the correct answer names the principle.

Least privilege is the sixth principle: every subject, user, program, and process should operate with the minimum set of rights necessary to complete its task. Least privilege is the principle the exam asks about more than any other in this list, and it is the easiest to test because it is the easiest to violate: the service account that holds domain administrator rights because it might need them someday, the analyst whose role grants every database permission because provisioning per-role access is work, the build agent that can modify production because it was given the union of everything it has ever needed. The standard backing is NIST SP 800-53 control AC-6, least privilege, and ISO/IEC 27001:2022 Annex A controls 5.15 and 5.18, which govern access control and the management of access rights, including the review and removal of rights that are no longer needed. The exam answer on least privilege is rarely subtle: it names the principle and the fix, which is to grant the narrow rights the task requires and to review them on a schedule.

Least common mechanism is the seventh principle: minimize the amount of mechanism shared by multiple users, because every shared mechanism is a shared point of failure and a shared blast radius. A shared temporary directory, a shared authentication library, a shared interpreter: any user who can influence the shared component can influence every other user who depends on it. The principle is the design-level ancestor of modern isolation and microsegmentation: when you cannot avoid sharing, you reduce the blast radius by containing the shared mechanism, and when you can avoid sharing, you isolate. The exam scenario is usually a shared service whose compromise affects all of its tenants, and the answer is least common mechanism, with containerization or per-tenant isolation as the fix.

Psychological acceptability is the eighth principle: the mechanism must be easy to use, because a control people cannot use comfortably is a control people will route around. Every security control is in competition with the user’s actual work, and the user wins that competition almost every time: passwords written on sticky notes, encryption disabled to make file sharing faster, classification prompts skipped because they take twelve clicks. The principle turns usability into a security requirement rather than a convenience. The exam question is the one where employees bypass a burdensome control and the correct answer is not more enforcement but a redesign of the control itself. NIST SP 800-160 Volume 1, the system security engineering standard, treats usability and the human element as part of the engineering discipline, and NIST SP 800-53’s SA-8 control requires that security and privacy engineering principles, which is the family that includes all eight of Saltzer and Schroeder’s rules, be applied to the system throughout its lifecycle.

Beyond the eight, a smaller modern family completes the vocabulary, and the exam treats these as principles even though they are not in the 1974 paper. Defense in depth is the layering of multiple, independent controls so that no single failure defeats the protection: network filtering, host controls, application-level validation, encryption, and monitoring, each capable of stopping or detecting what the layer before it missed. The word independent is the whole content of the principle: three firewalls from the same vendor running the same rule set are one layer three times, and the exam’s wrong answers are built from that confusion. Fail secure is the requirement that when a control fails, it fails to the safe state: a network firewall that loses power should deny traffic, not pass it, because the failure case must inherit the default of denial. Fail open is the opposite, and it has one legitimate home: life-safety exits, fire doors, and emergency egress systems must open on power loss because the harm of a locked exit exceeds the harm of a breached room. The exam presents a fail-open choice for a security control and the correct answer is fail secure, with the fail-safe defaults principle underneath it. Minimize attack surface is the reduction of interfaces, features, and entry points, which is CM-7 least functionality restated as architecture, and it completes the family.

The trust boundary

Architecture is where you draw lines. The most important line in any system is the trust boundary: the point at which the assumptions about who and what is trusted change. Everything on one side of the boundary operates inside a trust domain, a set of components that share the same security requirements and the same assumptions about their own integrity. Everything on the other side is different: a different owner, a different security posture, a different level of assurance. The boundary is not the firewall; the firewall is a control placed at the boundary. The boundary is the conceptual line where data or control moves from a domain you trust less into a domain you trust more, or from one domain into another domain with different rules.

Drawing the map is the discipline. An architect starts with the data flows: what data exists, where it is created, where it is stored, where it is processed, and where it crosses from one zone into another. Every crossing is a place where trust changes hands, and every place where trust changes hands is a place that needs a control: authentication at the edge of the domain, validation on the data entering the domain, encryption on the channel crossing it, monitoring on the traffic inside it. NIST SP 800-53 Revision 5 organizes this work as control SC-7, boundary protection, which requires the organization to monitor and control communications at the external boundary of the system and at key internal boundaries, and to place publicly accessible components in subnetworks physically or logically separated from the internal network. The pairing of “external boundary” and “key internal boundaries” is the exam’s favorite phrasing: the internal boundary between a web tier and a database tier is a trust boundary even though both are inside the company, because the threat models of the two tiers are different. A compromise that reaches the web tier must not automatically reach the data tier.

Two ideas follow from the trust boundary, and both are heavily tested. The first is transitive trust. Trust is transitive in the way that a chain is transitive: if A trusts B, and B trusts C, then A’s security now depends on C, whether A ever decided to trust C or not. The enterprise identity provider trusts a partner’s federation endpoint; the partner’s endpoint is compromised; every system that accepted the partner’s assertions as if they came from the enterprise now accepts the attacker’s. Transitive trust is not a bug; it is the cost of federation, and the architect’s job is to know where the chains run and to treat every member of the chain as an attack surface. The exam scenario is the vendor, the partner, or the third-party component whose compromise cascades to the enterprise, and the correct answer names the trust relationship as the vector.

The second idea is that a trust boundary is only as good as the enforcement at it, and enforcement has a failure mode the exam tests directly: the TOCTOU race already introduced with complete mediation. The check and the use must be a single operation, because the boundary between check and use is itself a trust boundary, one that exists in time rather than in space. The attacker who can act inside that window has crossed the boundary without a control. Modern enforcement answers this by making the decision and the enforcement continuous, which is the bridge from the reference monitor to Zero Trust later in this chapter.

The reference monitor and the trusted computing base

The theory of how access decisions are made was settled early and has never changed. In 1972, James P. Anderson’s study for the Air Force, “Computer Security Technology Planning Study”, introduced the reference monitor: an abstract machine that mediates all accesses by subjects to objects, deciding for every attempted access whether the access is permitted by the security policy. The idea was refined and made operational in 1985 by the Department of Defense Trusted Computer System Evaluation Criteria, TCSEC, DoD 5200.28-STD, the document known as the Orange Book, which defined the reference validation mechanism, the implementation of the reference monitor, and gave it three requirements.

The first requirement is tamperproof: the mechanism cannot be modified or bypassed by any party outside the trusted boundary, because a reference monitor the attacker can patch is a reference monitor that approves whatever the attacker wants. The second is complete mediation: the mechanism is invoked for every access, every time, with no path around it. The third is verifiability: the mechanism is small and simple enough to be subjected to analysis and testing, which returns to economy of mechanism, because a reference monitor so large that nobody can reason about it is a reference monitor nobody can trust. The exam loves these three as a set, and the standard question asks which of the three a described failure violates, or which option is not one of the three.

Around the reference monitor sits the trusted computing base, the TCB: the totality of protection mechanisms, hardware, firmware, and software, that enforce the security policy. The TCB is everything the system’s security depends on, which means it is also everything an attacker with physical access or a kernel exploit does not need. The security kernel is the portion of the operating system that implements the reference monitor, the layer where every subject-to-object access decision is evaluated. The architectural rule that follows is that the TCB should be as small as possible: the smaller the trusted base, the fewer components whose failure means total failure, and the more plausible the claim that the base has been analyzed. This is economy of mechanism elevated from a preference to a requirement, and it is why microkernels, virtualization boundaries, and hardware security modules all exist: each one is an attempt to shrink the TCB by pushing protection into a small, verifiable core.

The reference monitor’s weakness is that it only governs the accesses it is designed to see, and information can leave the system through paths the monitor never inspects. A covert channel is a mechanism by which one subject can signal to another against the policy, through shared resources: a storage channel through a shared file or cache, a timing channel through the observable duration of operations. Covert channels are the reason the verifiability requirement exists, and the exam touches them as the limitation that no access control model fully closes. The practical consequence for the architect is the one this chapter keeps returning to: the enforcement mechanism must be complete, small, and beyond reach, and every place where data flows outside it is a place the design must account for.

Architecture models: layers, rings, and modes

The principles and the reference monitor describe how controls should behave; the architecture models describe how systems are arranged. The exam expects the candidate to recognize the classic arrangements and the assumptions each one encodes.

The first model is layered or zoned architecture, defense in depth drawn as geography. The network is divided into zones with different trust levels: the untrusted exterior, the demilitarized zone where public services live, the internal network, and restricted zones for the most sensitive workloads. Each zone boundary is a trust boundary with controls at it, and traffic between zones is filtered, logged, and limited to what the business requires. The standard backing is explicit: ISO/IEC 27001:2022 Annex A control 8.22 requires segregation in networks, the separation of information services, users, and systems on different networks or zones, and control 8.20 governs networks security generally, while NIST SP 800-53 SC-7 operationalizes the same idea as boundary protection with internal as well as external boundaries. The exam question built on this material names a workload and asks where it belongs, and the correct answer is the zone whose trust level matches the data’s classification from Domain 2.

The second model is the protection ring. In ring architectures, the system is arranged as concentric circles of privilege, with the innermost ring carrying the highest privilege. The design descends from MULTICS and is visible in the Intel processor’s privilege levels, the four rings numbered zero through three, where ring zero holds the kernel and ring three holds ordinary user code, with intermediate rings reserved for drivers and services. Each ring boundary is a trust boundary, and the model encodes the principle that the closer to the center a component sits, the more it must be trusted and the less it should need to be. The modern versions of the model are the hypervisor, which runs below the operating system and is itself the new ring zero, and the trusted execution environment on many processors, a separate small world where a few operations run with hardware isolation from everything else. Both are attempts to shrink the innermost ring to a verifiable size, which is the same sentence the TCB section ended on.

The third model is the security modes of operation, and it is the one the exam tests most literally because it has a fixed vocabulary. TCSEC defined four modes describing who may be present in a computing environment and what they may access. In dedicated mode, every user is cleared for all data, has formal access approval for all data, and has valid need to know for all data, so any user may access any data. In system high mode, every user has clearance and formal access approval for all data, but not necessarily need to know for all of it, so access is granted only on a need-to-know basis. In compartmented mode, every user has clearance for all data but formal access approval for only some of it, the compartments they are read into, and access is limited accordingly. In multilevel mode, not every user has clearance for all data, and the system itself must enforce the restrictions across classification levels. The axis that separates the four is where the enforcement burden sits: dedicated and system high rely on administrative control over who is admitted to the environment, while multilevel requires the system to enforce the policy itself, which is exactly the job of the reference monitor. The exam question names a user population and asks which mode applies, and the two options candidates most often confuse are system high, where everyone is cleared but not everyone needs to know, and multilevel, where some users are simply not cleared for some of the data.

Zero Trust

The perimeter model assumes a wall: everything inside is trusted more than everything outside, and the wall is the control. The model worked while the enterprise was a building with doors, and it has been failing since the enterprise became a cloud, a VPN, and a collection of personal devices, because there is no single perimeter anymore and because the wall itself is not the protection it appears to be. Once an attacker breaches the perimeter, movement inside it is largely unhindered, which is the exact failure the perimeter was supposed to prevent. The term Zero Trust was coined by John Kindervag at Forrester Research in 2010, and its slogan, never trust, always verify, states the inversion plainly: trust is earned per access and never inherited from location. The idea had been building for a decade, from the Jericho Forum’s de-perimeterisation work in the early 2000s, and it matured into a standard in August 2020, when NIST published Special Publication 800-207, Zero Trust Architecture.

NIST SP 800-207 defines a zero trust architecture as an enterprise cybersecurity architecture based on zero trust principles, designed to prevent data breaches and limit internal lateral movement. The definition is the exam’s favorite sentence in the document, and its second half is the point: the architecture exists to contain the attacker who is already inside. The document states the position directly: zero trust security models assume that an attacker is present in the environment and that an enterprise-owned environment is no more trustworthy than a nonenterprise-owned one. The document then enumerates seven tenets, and the candidate who can restate them in plain terms has the whole model.

Tenet one: all data sources and computing services are considered resources. Tenet two: all communication is secured regardless of network location, because network location alone does not imply trust, and requests from inside the legacy perimeter must meet the same requirements as requests from outside it. Tenet three: access to individual enterprise resources is granted on a per-session basis, with least privilege, and access to one resource does not automatically grant access to another. Tenet four: access is determined by dynamic policy that considers the observable state of the requesting client, the user’s identity and its attributes, the application or service, device posture, behavior, and environmental context. Tenet five: the enterprise monitors and measures the integrity and security posture of all owned and associated assets, because no asset is inherently trusted. Tenet six: all authentication and authorization are dynamic and strictly enforced before access is allowed, with identity, credential, and access management (ICAM) and multifactor authentication as the expected foundations. Tenet seven: the enterprise collects as much information as possible about the current state of its assets, its network infrastructure, and its communications, and uses that data to improve its security posture. Together the seven tenets replace the wall with a gauntlet: every request, from everywhere, through every session, is evaluated on its own merits.

The architecture turns the tenets into components. NIST SP 800-207 divides the policy decision point into two logical pieces. The policy engine (PE) makes the decision: it applies enterprise policy and input from external sources such as continuous diagnostics and mitigation (CDM) systems and threat intelligence to a trust algorithm, and it grants, denies, or revokes access, logging the decision as it goes. The policy administrator (PA) executes the decision: it establishes or shuts down the communication path between the subject and the resource by commanding the enforcement points, and it generates the session-specific credentials a client uses. The policy enforcement point (PEP) is where the traffic actually passes: it enables, monitors, and eventually terminates connections between a subject and a resource, and it can be split into a client-side agent and a resource-side gateway, or run as a single portal. The architecture separates the planes: the policy engine and the policy administrator communicate with each other and with the enforcement points over the control plane, while the application data between subject and resource flows over the data plane. The exam question built on this material asks which component decides, enforces, or communicates over which plane, and the mapping to hold is: PE decides, PA executes, PEP enforces, the first two live on the control plane, and application traffic rides the data plane.

Two more Zero Trust ideas complete the model. Microsegmentation is the division of the environment into small, per-workload or per-resource segments, each with its own policy and its own enforcement, so that a compromise in one segment cannot travel sideways into another: lateral movement is contained segment by segment, which is tenet two’s network expression and least common mechanism’s modern form. NIST SP 800-207 describes three general deployment approaches: enhanced identity governance, where policy is driven by identity and entitlements; logical microsegmentation, where host-based agents enforce policy per workload; and network-based segmentation, where the enforcement is done by network devices in a software-defined or similar architecture. The three approaches share the same spine: decisions in the control plane, enforcement at the data plane, and no trust implied by where the request came from.

The manager-perspective point is that Zero Trust is a strategy, not a product. A vendor cannot sell an organization “a zero trust architecture” any more than a vendor can sell it “defense in depth”. What an organization can do is adopt the tenets, build the policy engine and its inputs, place the enforcement points, and change the operating assumption from trust the network, verify the user to verify everything, trust nothing implicitly. That change of assumption is the single most tested idea in this material, and the wrong answers on the exam are all versions of the old assumption: the VPN user who is trusted because they are on the corporate network, the internal IP address that is trusted because it is internal, the session that inherits trust because it authenticated once. Every one of those is tenet two, tenet three, or tenet six being violated.

The manager-perspective pattern

The questions built on this material fall into four shapes, and each shape has a reasoning pattern. The first shape names a scenario and asks which principle is at work or was violated, and the pattern is to find the single principle the scenario embodies: complexity argues for economy of mechanism, default permission argues against fail-safe defaults, a check that is skipped once is a complete mediation failure, shared state is a least common mechanism problem, a control users bypass is a psychological acceptability failure. The second shape names a system arrangement and asks about the model: the zones map to the zoned architecture, the kernel in the innermost ring maps to the ring model, and the user population maps to a security mode of operation, where the clearance-versus-need-to-know axis is the discriminator. The third shape tests the reference monitor and the TCB, and the pattern is the three requirements: tamperproof, complete mediation, verifiable, with TOCTOU as the scenario form of a mediation failure. The fourth shape tests Zero Trust, and the pattern is the tenet and the component: identify whether the scenario is about location-based trust, per-session authorization, dynamic policy, or continuous monitoring, and then map decision, execution, and enforcement to PE, PA, and PEP.

The wrong answers in all four shapes share a family resemblance, and naming the family eliminates them fast. One member is the bigger-hammer reflex: the answer that adds a stronger version of the same control, another firewall, more encryption, a longer password, when the scenario is really about a design decision, the placement of a boundary or the default behavior of a mechanism. Another member is the single-layer answer, the control that assumes one defense will hold, when the question is about defense in depth and the correct answer names the layers. A third member is the fail-open answer, the control that degrades to permission in the name of availability, when the correct answer fails secure. A fourth member is the location answer, the trust granted because the request came from the corporate network or the VPN, which is the exact assumption Zero Trust was built to retire. And a fifth is the once-and-done answer, the authentication that buys a session of trust, which tenet three of NIST SP 800-207 explicitly rejects.

The tie-breaker is the same one this book uses everywhere: which option would a responsible manager defend, with the principle named, the boundary drawn, and the standard cited? The option that names the principle and the standard, AC-6 for least privilege, SC-7 for boundary protection, 8.22 for network segregation, SP 800-207 for the zero trust tenet, is the option that survives scrutiny. Design questions are the rare exam questions where the correct answer is often the most abstract one, the principle rather than the product, because the exam is testing whether the candidate thinks like an architect: where the trust goes, how the controls fail, and what the system does when the perimeter is already gone.

Practice questions

1. A security architect must choose between two implementations of the same access-control function. One is a compact module with a few dozen lines of logic that an auditor can read completely in an afternoon. The other provides the same function through a large framework with hundreds of interacting features, many of them unused. Which design principle argues most directly for choosing the compact module?

A. Least privilege B. Economy of mechanism C. Separation of privilege D. Psychological acceptability

2. A file-sharing product is configured so that every authenticated user can read every file unless the file’s owner has explicitly denied that specific user access. A new file is created and, before anyone touches its settings, every user in the organization can read it. Which principle does this behavior violate?

A. Complete mediation B. Open design C. Fail-safe defaults D. Least common mechanism

3. To avoid blocking sales during a failure window, an e-commerce firewall is configured to pass all traffic whenever its inspection engine fails, and the failure is silently logged. Which principle does this configuration most directly violate?

A. Psychological acceptability B. Defense in depth C. Open design D. Fail-safe defaults

4. A developer argues that checking a user’s permissions once at login is sufficient, because roles rarely change during a session and re-checking every file access would cost performance. Which requirement of a reference validation mechanism does this argument reject?

A. Tamperproof design B. Verifiability C. Complete mediation D. Separation of privilege

5. Which statement best describes the security kernel?

A. The totality of hardware, firmware, and software that enforce the security policy B. The portion of the operating system that implements the reference monitor C. The firewall or gateway that separates trusted and untrusted networks D. The set of documented security policies an organization enforces

6. A payments application sends cardholder data from its web tier to its processing tier across an internal network. The two tiers are in different security zones, and the application’s external firewall is well configured. Where is the trust boundary that most needs a control in this scenario?

A. At the external firewall, because it is the only point of entry from the internet B. At the point where the data crosses from the web tier’s zone into the processing tier’s zone C. At each individual user’s endpoint device D. There is no trust boundary, because both tiers are inside the company network

7. An enterprise’s identity provider federates with a partner’s identity service, and the partner’s service is later compromised. Relying-party systems in the enterprise that accepted the partner’s assertions now accept the attacker’s. Which security concept explains why the enterprise is exposed?

A. Transitive trust B. Least common mechanism C. Fail-safe defaults D. Defense in depth

8. A privileged backup utility checks a file’s ownership and permissions, and then opens the file for reading. An attacker replaces the file between the check and the open, and the utility processes attacker-controlled content as if it had passed the check. What is this attack called, and what does it violate?

A. A man-in-the-middle attack, and it violates open design B. A time-of-check to time-of-use race, and it violates complete mediation C. A denial of service, and it violates least privilege D. A privilege escalation, and it violates separation of privilege

9. A government agency operates a network where every user holds a clearance for all data on the network, and formal access approval is not an issue, but each user is granted access only to the specific data their job requires. Under the TCSEC security modes of operation, which mode does this describe?

A. Dedicated mode B. System high mode C. Compartmented mode D. Multilevel mode

10. A system must store Top Secret and Secret data on the same platform while some authorized users hold only Secret clearances, and the system itself must enforce the access restrictions between the classification levels. Under the TCSEC security modes of operation, which mode does this describe?

A. Dedicated mode B. System high mode C. Compartmented mode D. Multilevel mode

11. A network architect argues that a laptop connected through the corporate VPN, physically inside the enterprise perimeter, can be trusted with the same confidence as always, because its requests arrive from inside the network. Which tenet of NIST SP 800-207 does this argument directly contradict?

A. Access to resources is granted on a per-session basis with least privilege B. All communication is secured regardless of network location, because network location alone does not imply trust C. The enterprise collects as much state information as possible to improve its security posture D. All data sources and computing services are considered resources

12. In the NIST SP 800-207 model, which component is responsible for the decision to grant, deny, or revoke a subject’s access to a resource?

A. The policy enforcement point B. The policy administrator C. The policy engine D. The resource-side gateway

13. In the NIST SP 800-207 model, which traffic travels over the data plane rather than the control plane?

A. Communications between the policy engine and the policy administrator B. Policy updates from the policy administrator to the policy enforcement point C. Application data flowing between a subject and a resource through the enforcement point D. Trust decisions logged by the policy engine

14. A user authenticates to the corporate VPN and, for the rest of the session, gains access to every server and application in the environment, with no further checks. Which zero trust principle does this arrangement most directly violate?

A. All communication is secured regardless of network location B. Access to individual resources is granted on a per-session basis, and access to one resource does not automatically grant access to another C. The enterprise monitors the integrity of all owned assets D. The enterprise collects state information to improve its security posture

15. An organization wants to protect an externally exposed web application that handles sensitive customer data. Which approach best implements defense in depth?

A. Purchase the strongest single web application firewall available and place it at the edge B. Apply multiple independent layers, network filtering, host hardening, application-level input validation, encryption, and monitoring, so that a failure in one layer is stopped or detected by another C. Encrypt all traffic in transit and at rest, and rely on encryption as the complete protection D. Move all protective controls into the application code so that there is one comprehensive enforcement point

16. A CI/CD build agent has been granted domain administrator credentials because a developer once said the build process might need them someday, and the credentials have never been reviewed. Which principle is violated, and which control is the fix?

A. Fail-safe defaults; force the agent to request access per job B. Least privilege; grant the agent only the rights its tasks require, and review them on a schedule C. Complete mediation; require re-authentication for every build D. Least common mechanism; run every build in an isolated container

17. A bank’s funds-transfer function executes only after two managers with different roles approve the transfer independently, and the system requires a distinct credential from each before it will act. Which principle does this arrangement implement?

A. Open design B. Economy of mechanism C. Separation of privilege D. Fail-safe defaults

18. Employees routinely bypass a mandatory document-classification prompt because it interrupts their work with a lengthy form and freezes the editor for several seconds, so documents leave the organization without classification labels. Which principle is violated, and what is the correct managerial response?

A. Least privilege; reduce the number of employees who can send documents B. Complete mediation; add a second prompt at the network edge C. Psychological acceptability; redesign the control so that classifying a document is fast, simple, and hard to skip D. Defense in depth; add a data-loss prevention layer to catch unclassified documents

Answers and rationales

1. B. Economy of mechanism holds that simplicity and smallness are the decisive factors in achieving assurance: a compact mechanism has fewer failure modes and can be fully analyzed. Least privilege governs rights granted (option A), separation of privilege requires multiple independent conditions (option C), and psychological acceptability concerns usability (option D).

2. C. Fail-safe defaults require that access decisions be based on explicit permission, so the default posture is denial. A product that grants access unless explicitly denied inverts the principle: every new object inherits permission until someone thinks to revoke it. Complete mediation concerns whether every access is checked (option A), not what the default answer is, and open design and least common mechanism are unrelated to the default behavior (options B and D).

3. D. Fail-safe defaults requires the failure case to inherit the default of denial, so a security control that degrades to passing traffic on failure violates the principle, and the modern form is the fail-secure requirement: firewalls fail closed, not open. The configuration is not about usability (option A), layering (option B), or secrecy of design (option C).

4. C. Complete mediation requires the reference validation mechanism to be invoked for every access, every time, with no shortcut and no cache. Checking permissions once at login and never again is the classic mediation failure, and TOCTOU is its race form. Tamperproofing concerns modification of the mechanism (option A), verifiability concerns analyzability (option B), and separation of privilege concerns multiple independent conditions (option D).

5. B. The security kernel is the portion of the operating system that implements the reference monitor, the layer that evaluates subject-to-object access decisions. The totality of protection mechanisms is the trusted computing base (option A), the gateway is a boundary control (option C), and the policy documents are governance artifacts (option D).

6. B. A trust boundary is where the assumptions about trust change, and the web tier and the processing tier have different threat models even though both are internal, which is why NIST SP 800-53 SC-7 requires control of communications at key internal boundaries as well as external ones. The external firewall is not the only relevant point (option A), the endpoint is not where this data’s trust changes hands (option C), and internal location does not remove the boundary (option D).

7. A. Trust is transitive: if the enterprise trusts the partner’s identity service, and that service is compromised, the attacker inherits the trust the enterprise placed in it, exposing every relying party in the chain. Least common mechanism, fail-safe defaults, and defense in depth are principles, but the concept explaining the exposure is transitive trust (options B, C, and D).

8. B. The attack is a time-of-check to time-of-use race, the window between verifying a condition and acting on it, and it is a failure of complete mediation, whose defense is to make the check and the use a single atomic operation. The other attack names do not describe the check-then-use window (options A, C, and D).

9. B. System high mode applies when every user is cleared for all data but does not have need to know for all of it, so access is granted on a need-to-know basis. Dedicated mode grants everyone access to everything (option A), compartmented mode restricts by formal access approval to compartments (option C), and multilevel mode is where some users are not cleared for all data (option D).

10. D. Multilevel mode applies when not every user is cleared for all data and the system itself must enforce the restrictions across classification levels, which is the job of the reference monitor. The other modes assume clearance for all data and rely on administrative control over the environment (options A, B, and C).

11. B. Tenet two of NIST SP 800-207 states that all communication is secured regardless of network location, because network location alone does not imply trust, and requests from inside the legacy perimeter must meet the same requirements as requests from outside. The argument being made is precisely the location-based trust the tenet retires. The other tenets are not about location (options A, C, and D).

12. C. The policy engine makes the decision to grant, deny, or revoke access, applying enterprise policy and external inputs through a trust algorithm and logging the decision. The policy administrator executes the decision (option B), and the policy enforcement point enables, monitors, and terminates the connection (options A and D).

13. C. NIST SP 800-207 places application data flowing between a subject and a resource through the enforcement point on the data plane, while the policy engine, the policy administrator, and the enforcement point communicate among themselves over the control plane (options A, B, and D).

14. B. Tenet three grants access on a per-session basis with least privilege, and authentication to one resource does not automatically grant access to another. A VPN login that opens every server for the whole session violates per-session authorization. The other tenets are real but are not the direct target of this scenario (options A, C, and D).

15. B. Defense in depth is the layering of multiple, independent controls so that no single failure defeats the protection, and the independent layers are the whole content of the principle. One strong firewall (option A) is a single layer, encryption alone (option C) protects only one property of the data, and a single comprehensive enforcement point (option D) is the opposite of layering.

16. B. Least privilege requires every subject to operate with the minimum rights necessary for its task, and the fix is to grant only the rights the build agent’s jobs require and to review them on a schedule, which is the discipline of NIST SP 800-53 AC-6 and ISO/IEC 27001:2022 Annex A controls 5.15 and 5.18. The other options name principles but not the one the scenario violates or the actual fix (options A, C, and D).

17. C. Separation of privilege requires two independent conditions before a sensitive action, so the dual-approval transfer with distinct credentials implements it mechanically, which is the system-level form of separation of duties. Open design, economy of mechanism, and fail-safe defaults are not about requiring multiple independent approvals (options A, B, and D).

18. C. Psychological acceptability holds that a control people cannot use comfortably will be routed around, so the correct response to a bypassed control is redesigning it to be fast, simple, and hard to skip, treating usability as a security requirement. Reducing who can send documents (option A) does not fix the bypass, a second prompt (option B) adds friction to a control that is already too burdensome, and a DLP layer (option D) detects the failure instead of fixing the design that causes it.

Security design principles on one page

Hold the spine and the rest hangs together. The spine is that architecture is where trust is placed, and the principles decide how controls behave. Saltzer and Schroeder’s eight, from the 1974 Communications of the ACM paper, are economy of mechanism, fail-safe defaults, complete mediation, open design, separation of privilege, least privilege, least common mechanism, and psychological acceptability, and the modern family adds defense in depth, fail-secure behavior, secure defaults, and minimized attack surface, with NIST SP 800-53 AC-6, CM-7, SC-7, SC-2, and SA-8 and ISO/IEC 27001:2022 Annex A 5.15, 5.18, and 8.22 carrying the operational versions. The trust boundary is the line where trust assumptions change, and the discipline is drawing the data flows, finding every internal and external crossing, and placing controls there, because transitive trust and TOCTOU are the two ways a boundary betrays you. The reference monitor mediates every subject-to-object access, the TCB is everything the policy depends on, the security kernel is the OS portion that implements the monitor, and the three requirements are tamperproof, complete mediation, and verifiable. The architecture models are the zones of the layered network, the protection rings with the kernel at ring zero, and the TCSEC security modes, where the axis from dedicated to system high to compartmented to multilevel is how much the system itself must enforce. Zero Trust, per NIST SP 800-207, assumes the attacker is already present, grants nothing from location, authorizes per session against dynamic policy, and enforces through the policy engine that decides, the policy administrator that executes, and the policy enforcement point that carries the traffic, with the control plane and the data plane kept separate and microsegmentation containing lateral movement. When the exam offers a bigger hammer, a single layer, a fail-open control, or a trust granted by network location, discard it, and keep the answer that names the principle, draws the boundary, and cites the standard.

Chapter 13 takes the mathematics the principles rely on: cryptography and key management, where open design meets published algorithms and secret keys, and where the reference monitor’s decisions are protected in transit and at rest. Before you go, hold the sentence this chapter keeps returning to: the perimeter is a line on a map, and the architect’s job is not to make the line thicker but to make the land on both sides of it unyielding.