Security Architecture · Topic 1 of 12
Resilient Design and High Availability
Design for availability with redundancy, clustering, load balancing, failover, geographic spread, diversity, scaling and fail open versus fail closed.
- 5 min
- Availability targets come from business impact, and each extra nine costs much more.
- Remove single points of failure, including shared power, network and software dependencies.
- Active active uses all nodes, while active passive keeps a standby and takes longer to fail over.
What it is
A resilient system keeps delivering its service when parts fail, when load spikes, or when an attacker applies pressure. Availability is one of the three security goals, so resilience is a security requirement and not only an operations concern.
Design starts from requirements: how much downtime the business can accept, how much load to expect, and what must keep working during a partial failure. You then pick the cheapest design that meets those targets.
How it works
Availability targets
Availability is often quoted in nines of uptime per year.
| Availability | Approximate downtime per year |
|---|---|
| 99 percent | About 3.65 days |
| 99.9 percent | About 8.8 hours |
| 99.99 percent | About 53 minutes |
| 99.999 percent | About 5 minutes |
Each extra nine costs far more than the one before, so the target must come from the business impact analysis. Redundant parts that depend on the same power, switch or software version still fail together, so removing single points of failure (SPOF) must reach the shared dependency.
Redundancy and failover patterns
| Pattern | How it works | Trade off |
|---|---|---|
| Active active | All nodes serve traffic at once | Best use of capacity, but needs state sharing and spare headroom |
| Active passive | A standby takes over on failure | Simpler, but the standby is idle and failover takes time |
| N plus 1 | One spare beyond the number needed | Cheap, survives one failure |
| Clustering | Nodes act as one system with shared state and heartbeats | Fast failover, but nodes are tightly coupled |
Load balancing and clustering differ. A load balancer spreads requests across independent nodes and removes unhealthy ones using health checks. A cluster coordinates nodes that share state or storage, so that another node resumes the work of a failed one.
Layer 4 load balancers route on addresses and ports, while layer 7 balancers can route on uniform resource locators (URLs), headers or cookies and can also terminate Transport Layer Security (TLS) and inspect traffic.
Geographic and site considerations
Spreading systems across availability zones or regions survives a data center loss, a regional outage or a disaster. The costs are data replication delay, higher complexity, and legal limits on where data may be stored. Choose regions with the sovereignty rules from the compliance page in mind.
Diversity
Diversity reduces common mode failure. Using different vendors, operating systems, carriers or cloud providers means one bug or one outage does not hit everything. The cost is more skills, more tools and more patching work.
Scalability and capacity
Vertical scaling adds resources to one node. Horizontal scaling adds more nodes behind a balancer. Horizontal scaling gives better resilience and works well with elastic cloud capacity, but the application must tolerate stateless or shared state designs.
Capacity planning covers people, technology and infrastructure. Plan for peak load plus attack traffic, since a distributed denial of service (DDoS) attack can look like a traffic spike. Rate limiting, content delivery networks and upstream scrubbing services absorb it.
Failure behavior: fail open and fail closed
When a control fails, it must default to a safe state. Fail closed, also called fail secure, blocks access, as a firewall that denies everything on failure. Fail open allows access, which suits safety systems such as an exit door that must unlock in a fire.
Choose by consequence. For confidential data fail closed. For life safety fail open, and compensate with other controls.
Resilience against attack
Immutable and non persistent systems, which are rebuilt from a known image instead of repaired, remove attacker footholds on each restart. Graceful degradation keeps critical functions alive while turning off optional ones under stress. Chaos style testing, where failures are injected on purpose, shows whether failover really works.
What to remember for the exam
- Availability targets come from business impact, and each extra nine costs much more.
- Remove single points of failure, including shared power, network and software dependencies.
- Active active uses all nodes, while active passive keeps a standby and takes longer to fail over.
- Load balancers distribute traffic and use health checks, while clusters share state to take over work.
- Layer 7 balancing can inspect application content, layer 4 cannot.
- Horizontal scaling adds nodes and improves resilience, vertical scaling adds power to one node.
- Fail closed protects confidentiality, fail open protects human safety.
- Diversity limits common mode failure but increases operating complexity.
If two redundant systems share a power feed, a switch or a certificate, the exam answer is usually to remove that shared dependency.
Common mistakes
Assuming redundancy equals backup. Redundancy handles hardware failure in real time, but it also copies corruption and deletion, so you still need backups.
Ignoring state. Failing over to a node that has no session or data state causes errors even when the node is healthy.
Over building. Five nines for a low impact internal tool wastes budget that the business impact analysis would assign elsewhere.
Forgetting to test failover. An untested standby often fails when needed because of stale configuration or expired certificates.
A health check that only tests whether a server responds can send traffic to a node that is up but broken, so check the application path.
Check yourself
Work through these three questions.
What separates a load balancer from a cluster?
A load balancer spreads requests across independent nodes, whereas a cluster shares state so another node can take over a failed node's work.
When should a control fail open?
When human safety depends on access, such as an emergency exit, and other controls compensate.
Why is horizontal scaling usually better for resilience?
Adding nodes spreads load and removes single points of failure, while a bigger single node is still one point of failure.
Topic 1 of 12 in Security Architecture
Test yourself on Security Architecture
The full CompTIA SecurityX CAS-005 question bank has 654 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.