CISSP — Architecture, Engineering and Network Security flashcards
10 of 78 cards free to study here · 2 topics · the whole deck is built into Willys
CISSP domains 3 and 4 for architects: secure design principles, Bell–LaPadula, Biba, Clark–Wilson and Brewer–Nash, Common Criteria EALs, crypto choices and key management, physical security, protocol layers, IPsec, network attacks, segmentation, VPNs and wireless.
Learn deck · part of ISC2 CISSP · written against: CISSP exam outline (domains effective April 2024). Updated 2026-10-10.
Study the free sample
10 cards from the deck as they are. Flip, rate yourself, filter by topic; your progress stays in this browser.
Tap the card or press Space to flip
The 10 sample cards as a list
-
How does least privilege differ from need to know?Least privilege limits the permissions a user or process holds to the minimum its function requires; need to know limits access to specific information to what current duties require — even when a clearance would otherwise allow more.Security Architecture and Engineering › Secure Design Principles
-
Why is defence in depth preferred over relying on one very strong perimeter control?Layered, independent controls of different kinds mean a single failure or bypass does not expose the asset; each layer buys time to detect and respond.Security Architecture and Engineering › Secure Design Principles
-
A database product ships with sample accounts disabled, remote administration off and encryption on. Which design principle does this show?Secure defaults — the out-of-the-box configuration is the safe one, and users must deliberately opt in to riskier settings.Security Architecture and Engineering › Secure Design Principles
-
A firewall's rule engine crashes. What should a fail-secure design do, and what does it trade away?Fail closed — block all traffic until the device recovers. Confidentiality and integrity are preserved at the cost of availability; failing open would do the reverse.Security Architecture and Engineering › Secure Design Principles
-
Which design principle ensures the person who writes a code change cannot also approve and deploy it to production?Separation (segregation) of duties — splitting a sensitive task between roles so that fraud requires collusion.Security Architecture and Engineering › Secure Design Principles
-
How do the four TCP/IP layers map onto the OSI model?Link (network access) covers OSI 1–2, Internet covers 3, Transport covers 4, and Application covers 5–7.Communication and Network Security › Network Models
-
A WAF and a stateless packet filter both sit in front of a web app. At which OSI layers does each make decisions?The WAF at layer 7, reading HTTP content; the packet filter at layers 3 and 4, reading addresses, ports and protocol only.Communication and Network Security › Network Models
-
What are converged protocols, and what security risk do they create?Protocols that carry storage, voice or other specialised traffic over standard Ethernet or IP networks, such as iSCSI, FCoE and VoIP. Critical traffic now shares the data network's threats, so it needs isolation and its own protections.Communication and Network Security › Network Models
-
Does an MPLS WAN encrypt traffic between sites?No. MPLS label switching keeps customers' traffic logically separate, but it is not encryption; sensitive traffic still needs IPsec or similar on top.Communication and Network Security › Network Models
-
In IPsec, how does AH differ from ESP?AH authenticates and integrity-protects the packet, including most of the IP header, but provides no confidentiality and fails when NAT rewrites the header; ESP provides encryption plus integrity of the payload.Communication and Network Security › Secure Protocols
Unlock the whole deck
You are studying a free 10-card sample. All 78 cards of CISSP — Architecture, Engineering and Network Security, the other 5 ISC2 CISSP decks, and spaced-repetition scheduling are built into Willys. 14-day free trial, then $14.99 a year.
In Willys, tap Exam Library at the top of your Decks (or Browse Exam Library… under the + button), find the exam on its shelf or by search, tick it and tap Add.
More ISC2 CISSP decks
← All ISC2 CISSP decks, with the study guide and topic outline.
About these cards
Review status: Second-reader reviewed, with corrections applied.
Checked against:
- ISC2 CISSP exam outline (domains effective April 2024) — topic outline only; no text copied
These are independent study notes written for Willys. They are not official exam material, may contain mistakes, and are no substitute for your course, your teacher or the exam owner's own publications. Found an error? Tell us — corrections ship as a new version of the deck.
CISSP® is a registered mark of ISC2, Inc. This product is not affiliated with or endorsed by ISC2.
Use of these pages is covered by our Terms of Use.