How should I use these Security Architecture and Engineering practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

CISSP · topic practice

Security Architecture and Engineering practice questions

Q: Can I practise just Security Architecture and Engineering questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Security Architecture and Engineering domain.

Practise Certified Information Systems Security Professional CISSP Security Architecture and Engineering practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Security Architecture and Engineering

Practice 10 questions Browse domain →

What the exam tests

What to know about Security Architecture and Engineering

Security Architecture and Engineering questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Security Architecture and Engineering exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Security Architecture and Engineering questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full Security Architecture and Engineering explanation →

A security architect is designing a system for a military intelligence agency where data classification labels (Top Secret, Secret, Confidential, Unclassified) are mandatory. Users are cleared to a specific level and must not read data above their clearance. Which security model enforces this type of access control?

Trap 1: Biba model

Biba addresses integrity, not confidentiality.

Trap 2: Brewer-Nash model

Brewer-Nash (Chinese Wall) prevents conflict of interest, not classification-based access.

Trap 3: Clark-Wilson model

Clark-Wilson focuses on commercial integrity and well-formed transactions.

Study all Security Architecture and Engineering common traps →

A
Bell-LaPadula model
Correct. Bell-LaPadula enforces confidentiality via no read up and no write down.
B
Biba model
Why wrong: Biba addresses integrity, not confidentiality.
C
Brewer-Nash model
Why wrong: Brewer-Nash (Chinese Wall) prevents conflict of interest, not classification-based access.
D
Clark-Wilson model
Why wrong: Clark-Wilson focuses on commercial integrity and well-formed transactions.

Security Architecture and Engineering practice questions

What to know about Security Architecture and Engineering

Common Security Architecture and Engineering exam traps

Security Architecture and Engineering questions

Which access control model allows data owners to grant or revoke access to resources they own, typically implemented using ACLs?

An organization is implementing a PKI for internal use. To ensure that certificate revocation status is checked in real-time without relying on periodic CRL downloads, which mechanism should be used?

A security engineer is analyzing a vulnerability where an attacker can cause a buffer overflow on the stack. Which mitigation technique randomizes memory addresses to make it harder for the attacker to predict the location of shellcode or return addresses?

Which of the following is a primary function of a Trusted Platform Module (TPM)?

A security architect is evaluating hypervisor security for a multi-tenant cloud environment. Which type of hypervisor is considered more secure because it runs directly on the hardware without a host operating system, reducing the attack surface?

Which physical security design principle emphasizes that the physical environment should be designed to discourage criminal activity by using natural surveillance, access control, and territorial reinforcement?

A security analyst discovers that an application allows a user to read a file they just wrote before the file's integrity is verified, due to a gap between the time of check and time of use. This is an example of which vulnerability?

A security architect is designing a system that must prevent conflicts of interest when a consultant works for two competing clients. Which security model ensures that the consultant cannot access data from one client if they have already accessed data from the other?

Which component of a trusted computing base (TCB) implements the reference monitor concept by enforcing access control decisions for all subjects and objects in the system?

A security engineer is investigating a covert channel in a system. Which TWO types of covert channels could be used to leak information from a high-security to a low-security process?

An organization is implementing a defense-in-depth strategy for a data center. Which THREE of the following are examples of physical security controls that align with layered defense?

A government agency requires a security model that prevents users from reading documents at a higher classification level and from writing to documents at a lower classification level. Which model enforces these constraints?

An organization implements a security model where users can only read objects at or below their security clearance, and can only write to objects at or above their clearance. This model primarily ensures:

A financial institution must ensure that transactions are well-formed and enforce separation of duties to prevent fraud. Which security model best addresses these requirements?

Which access control model allows the owner of a resource to grant or deny access to other users?

An organization uses a system where access decisions are based on user attributes (e.g., job title, clearance), resource attributes (e.g., classification), and environmental factors (e.g., time of day). This is an example of:

Track your progress over time

Start a Security Architecture and Engineering only practice session

Related CISSP topic practice pages

Security and Risk Management practice questions

Asset Security practice questions

Security Operations practice questions

Security Architecture and Engineering practice questions

Communication and Network Security practice questions

Security Assessment and Testing practice questions

Software Development Security practice questions

Identity and Access Management practice questions

CISSP fundamentals practice questions

CISSP scenario practice questions

CISSP troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid