Chapter 3 of 5 · CompTIA Security+ SY0-801
Security Architecture
Architecture models, infrastructure, Zero Trust, data protection and resilience.
- 7topics
- 37 minfast track
- 4diagrams and exhibits
- 19%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Cloud and Infrastructure ModelsSecurity+ architecture models: cloud deployment models, multicloud, serverless, IaC, OT, on premises, air gaps, microservices and…Diagram6 min
- 2Technical and Business Design ConsiderationsSecurity+ design trade offs: availability, resilience, open source, usability, compute, power, data sovereignty, cost, ownership…5 min
- 3Secure Infrastructure Design and Zero TrustSecurity+ infrastructure design: device placement, security zones, attack surface, diversity, fail open versus fail closed and…Diagram6 min
- 4Secure Communication, Access and IdentitySecurity+ secure access: VPNs, tunneling, remote access, out of band management, secure file transfer, SSE, gMSAs and avoiding…5 min
- 5Data Types, States and Protection MethodsSecurity+ data protection: structured and unstructured data, data states, classification labels, and masking, hashing…5 min
- 6Data Roles, Handling, Life Cycle and ComplianceSecurity+ data roles from owner to subprocessor, data handling and geofencing, the data management life cycle, and compliance for…5 min
- 7Resilience and Recovery PlanningSecurity+ resilience planning: hot, warm and cold sites, redundancy, power, storage, immutable backups, failover testing, RTO…Diagram5 min
About this chapter
What this chapter covers
Security Architecture is about designing environments that are safe by structure, not only by settings. It is 19% of the CompTIA Security+ SY0-801 exam.
It has four objectives: the security effects of different architecture models, managing the security architecture to protect the infrastructure, strategies for protecting data, and resilience and recovery. Questions here often give a design or a failure and ask for the best choice.
How the topics fit together
The chapter moves from the shape of the environment to the data inside it, and then to what happens when something fails.
- Architecture models decide who is responsible for what and where the risks sit.
- Infrastructure design places zones and devices, applies Zero Trust and secures every connection.
- Data protection applies the right method, role and handling rule to the right data.
- Resilience keeps services running and lets you recover from the loss of a system or a site.
Many questions are trade off questions. Look for the option that best fits the stated priority, such as availability, cost or security.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with diagrams and tables.
- What to remember for the exam: the facts to memorize.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Read the pages in order, since the later pages build on the zones and models described earlier.
Ready for more practice?
The full CompTIA Security+ SY0-801 question bank has 998 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.