Chapter 3 of 5 · CompTIA Security+ SY0-701
Security Architecture
Architecture models, secure infrastructure, data protection, resilience and recovery.
- 6topics
- 26 minfast track
- 5diagrams and exhibits
- 18%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Cloud and Infrastructure ModelsSecurity+ architecture models: cloud shared responsibility, hybrid, IaC, serverless, microservices, SDN, containers…4 min
- 2Specialized Systems and Design FactorsSecurity+ guide to IoT, ICS, SCADA, embedded and real time systems, and the design trade offs of availability, cost, scalability…Diagram4 min
- 3Network Design and Security AppliancesSecure network design for Security+: zones, screened subnet, IDS versus IPS, fail open and fail closed, proxies, jump servers and…Diagram5 min
- 4Firewalls, VPNs and Secure AccessSecurity+ firewall types and rules, VPN designs, IPsec tunnel and transport modes, split tunneling, SD-WAN, SASE and 802.1X port…Diagram5 min
- 5Data Protection StrategiesSecurity+ data protection: data types, classification labels, data states, sovereignty, and methods like encryption, masking…4 min
- 6Resilience and Recovery PlanningSecurity+ resilience and recovery: high availability, hot warm cold sites, RTO and RPO, backup types, power, testing and…Diagram4 min
About this chapter
What this chapter covers
Security Architecture is about designing environments that are safe by structure, not only by settings.
It has four outline topics: the security effects of different architecture models, the principles for securing enterprise infrastructure, strategies for protecting data, and resilience and recovery. Questions here often give a design or a failure and ask for the best choice.
How the topics fit together
The chapter moves from the shape of the environment to the data inside it, and then to what happens when something fails.
- Architecture models decide who is responsible for what and where the risks sit.
- Infrastructure principles place zones, appliances and secure connections.
- Data protection applies the right method to the right data.
- Resilience keeps services running and lets you recover from the loss of a system or a site.
Many questions are trade off questions. Look for the option that best fits the stated priority, such as availability, cost or security.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with diagrams and tables.
- What to remember for the exam: the facts to memorise.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Read the pages in order, since the later pages build on the zones and appliances described earlier.
Ready for more practice?
The full CompTIA Security+ SY0-701 question bank has 848 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.