Study ISC2 CISSP Trust Boundaries: key concepts, common traps, and exam decision cues.
On this page
Architecture questions usually get easier when you name the security objective first. CISSP is often testing whether the system primarily needs confidentiality, integrity, availability, or conflict-of-interest control.
Design-choice map
Requirement
Better first instinct
reduce trust and blast radius
segmentation and clear trust boundaries
protect confidentiality by label
Bell-LaPadula reasoning
protect integrity against contamination
Biba or Clark-Wilson depending on context
minimize privilege and failure impact
least privilege, fail securely, defense in depth
What the exam is really testing
If the stem says…
Strong reading
“classified environment”
Bell-LaPadula is often relevant
“commercial transaction integrity”
Clark-Wilson may fit better
“conflict of interest”
Brewer-Nash or Chinese Wall thinking
“secure design principles”
the question is about architecture, not product marketing
Decision order that usually wins
Name the primary security objective first.
Decide whether the problem is about architecture principles or a classic model.
Check where the trust boundary sits and how failure should behave.
Match the model or principle to the actual business risk.
Only then choose the product or technical pattern.
These questions are easier once you stop treating classic models like trivia. CISSP usually wants evidence that you can connect confidentiality, integrity, or conflict-of-interest goals to the right architecture decision.
Scenario triage
Scenario
Better first move
multilevel classified data with label-based access
Bell-LaPadula reasoning
transaction workflow needs controlled validity and separation
Clark-Wilson logic
integrity contamination between subject and object matters
Biba-style reasoning
consultants must not access competing clients’ data sets
Brewer-Nash thinking
design should contain compromise impact
least privilege, trust boundaries, and fail-secure design
Common traps
Trap
Better rule
choosing a model by memorized slogan without matching the business objective
match the model to the problem first
treating least privilege as only an IAM concept
it is also a system-design principle
forgetting fail-secure behavior
architecture includes what happens when components break