CISSP - Security Architecture and Engineering (13% of the exam) - Section 3.1

Research, implement, and manage engineering processes using secure design principles such as least privilege, defense in depth, zero trust, and secure defaults.

Apply secure design principles - including zero trust, defence in depth, least privilege, secure defaults, and privacy by design - when researching and implementing engineering processes. Distinguish the scenarios where zero trust architecture is the appropriate choice over traditional perimeter-based defence.

zero trustdefense in depthleast privilegesecure defaultsprivacy by design

Practice question for this objective

Free sampleSecurity Architecture and Engineeringmedium

A security architect is briefing a board on the difference between defence in depth and zero trust as guiding design principles for a new corporate platform. Which statement BEST captures the conceptual distinction between the two?

ADefence in depth layers independent controls so that the failure of any single control does not breach the asset, whereas zero trust removes implicit trust based on network location and continuously verifies each subject, device, and request. Correct
BDefence in depth is a network segmentation technique that encrypts traffic between tiers, while zero trust is a procurement requirement that all suppliers attest to their secure software development practices.
CDefence in depth replaces perimeter firewalls with identity-aware proxies, while zero trust focuses on encrypting data at rest and in transit at every storage tier.
DDefence in depth and zero trust are interchangeable terms describing layered authentication, with defence in depth being the older vendor label and zero trust being the modern one.

Distinguish defence in depth as a layered-controls strategy from zero trust as a per-request verification model that removes implicit network trust. Defence in depth assumes individual controls will fail and builds redundancy so that compromise of one layer does not breach the asset. Zero trust is a trust model that abandons the assumption that traffic from inside the network can be trusted, requiring identity, device, and context to be verified on every request. The two are complementary but conceptually distinct: one is about layering, the other is about not granting trust by location.

Why A is correct: This correctly frames defence in depth as a layered-controls strategy whose value is failure tolerance, while zero trust is a trust model that replaces network-perimeter assumptions with per-request verification of identity, device posture, and context.

Why B is wrong: This is tempting because both ideas are often discussed alongside segmentation and supply-chain trust, but defence in depth is a broader layered-controls strategy not limited to network segmentation, and zero trust is a security model rather than a procurement clause.

Why C is wrong: This inverts the two concepts: identity-aware proxies are typical of zero trust enforcement, and ubiquitous encryption is a cryptographic control rather than the essence of either principle.

Why D is wrong: Candidates sometimes treat the terms as synonyms because both involve multiple checks, but they describe different ideas: layered independent controls versus an architectural trust model with no implicit network trust.

See more CISSP practice questions, answers explained.

Exam traps in Security Architecture and Engineering

Answers that look right on this material and are not. Each one is a distractor from a different question in the CISSP bank for this domain.

Each role should be granted broad read access across the application to reduce help desk tickets, with write actions logged for after-the-fact review by the audit team.
Why it is wrong: Wide read access for convenience and reliance on after-the-fact audit is a detective compromise, not least privilege. The principle calls for restricting access in the first place, even where logging is available.
Install a closed-circuit camera in the corridor outside the cupboard door and review the recordings weekly for anomalies.
Why it is wrong: Camera surveillance is a useful detective control but does not prevent unauthorised access. While the wiring closet continues to share a key with cleaners, an attacker or insider can still tamper with the switch before any review takes place.
The platform must obtain explicit consent before any personal data is collected, regardless of whether the processing has a separate lawful basis under data protection law.
Why it is wrong: This conflates the default setting principle with the lawful basis question. Consent is one lawful basis under privacy law but the default setting principle is about what happens when the user does nothing, not which lawful basis applies.

Examworthy is not affiliated with or endorsed by ISC2. Original, blueprint-aligned practice material only.