Domain 3 is the most technically dense domain on the exam: security engineering principles, formal security models (Bell-LaPadula, Biba, Clark-Wilson), cryptography, and physical security. It carries significant weight (13%) and is where candidates from a pure GRC background often need to spend the most additional study time, since it assumes comfort with technical concepts the other domains don't require.
Bell-LaPadula vs. Biba
Bell-LaPadula protects confidentiality ("no read up, no write down"); Biba protects integrity ("no read down, no write up"). They're mirror images of each other, which is exactly why they're confused.
Symmetric vs. asymmetric cryptography
Symmetric (AES) is fast, uses one shared key, and has a key-distribution problem. Asymmetric (RSA, ECC) solves key distribution using public/private key pairs but is computationally expensive, which is why TLS uses asymmetric crypto only to establish a symmetric session key.
Hashing vs. encryption
Hashing is one-way (integrity/verification); encryption is reversible with the right key (confidentiality). A hash is not "weak encryption," it's a fundamentally different operation with no decryption path at all.
Security modes of operation
Dedicated, system high, compartmented, and multilevel describe how a system handles users with different clearance levels accessing data of different classifications simultaneously.
Trusted Platform Module (TPM)
Hardware-based root of trust used for secure boot, key storage, and remote attestation, increasingly tested alongside newer concepts like Trusted Execution Environments (TEEs) and confidential computing.
Bell-LaPadula vs. Biba (again)
Worth repeating: confidentiality model means read down is OK, write up is OK (protects secrets from leaking down). Integrity model means read up is OK, write down is OK (protects clean data from corruption by less-trusted sources).
Digital signature vs. encryption
A digital signature (a hash encrypted with the sender's private key) proves authenticity and non-repudiation; it does not provide confidentiality on its own. Confusing "signed" with "encrypted" is a common exam trap.
Practice D3 questions with instant feedback, free to start, no card required.
Start Free