Domain 3: Security Architecture
Architecture is about designing things to be secure from the start: where systems live, how networks are split up, how data is protected, and how you keep running when something fails. It’s about 18% of SY0-701.
What changes in V8 for this domain: Weight is about 19%. The four objectives look much the same in CompTIA's V8 summary, with operational technology and connected environments called out.
Architecture models
- On-premises: you control everything and you’re responsible for everything.
- Cloud and the shared responsibility model: in IaaS the provider runs the hardware and you manage the OS and apps. In PaaS the provider also runs the platform and you manage your code and data. In SaaS the provider runs the app, but you still own your users, data and settings.
- Hybrid: a mix of on-premises and cloud.
- Virtualization and containers: containers share the host’s kernel, which affects how well they’re isolated.
- Serverless, edge, IoT, embedded, and OT/ICS: each has different limits. Industrial systems put safety and uptime first, so they often can’t just be patched and rebooted.
- Infrastructure as Code: environments defined in version-controlled files, so they’re repeatable and reviewable.
Secure enterprise infrastructure
Plan trust boundaries and allow only the traffic you need. Avoid one big flat network.
- Screened subnet (DMZ): where internet-facing servers go, kept apart from internal systems.
- Firewalls enforce rules, VPNs create encrypted tunnels, and NAC checks a device before it joins the network.
- Microsegmentation: fine-grained rules between individual workloads.
- SDN: network control handled by software, so it can be programmed.
- Jump server: a single, controlled place admins connect through.
- Fail-secure vs. fail-open: decide whether a failure should lock things down or keep them usable.
Data protection
Data needs protection in three states: at rest (stored), in transit (moving over a network), and in use (being processed in memory).
- Classification labels data by sensitivity and sets the handling rules.
- Encryption protects data at rest and in transit.
- Tokenization swaps a real value for a token that maps back to it in a protected vault.
- Masking hides part of a value, like showing only the last four digits.
- DLP watches for sensitive data leaving where it shouldn’t and blocks it.
- Retention rules set how long to keep data and when to destroy it.
Resilience and recovery
- RTO: how fast a service must be back. RPO: how much data, measured in time, you can afford to lose.
- Backups: full copies everything. Incremental copies changes since the last backup of any kind. Differential copies changes since the last full backup.
- 3-2-1 rule: three copies, on two types of media, with one off-site.
- RAID handles a failed drive. It is not a backup.
- High availability: redundancy, load balancing, and capacity in more than one location. Test your restores, not just your backups.
Key terms
Try to define each term before you tap it.
IaaS
Provider handles physical infrastructure; customer commonly manages OS and workloads
PaaS
Provider also manages runtime/platform components; customer manages applications and data
SaaS
Provider operates application; customer configures access and protects appropriate data
Hybrid cloud
Mix of on-premises and cloud environments
Container
OS-level isolation with shared kernel implications
OT/ICS
Operational technology prioritizing safe, continuous physical processes
Infrastructure as Code
Reproducible configuration defined through version-controlled code
Screened subnet (DMZ)
Isolated segment for internet-facing services, kept apart from the internal network
NAC
Controls network admission based on device or user posture
VPN
Encrypted tunnel across an untrusted network
Microsegmentation
Granular policies between workloads
SDN
Separates network control logic from forwarding for programmable management
Jump server
Controlled intermediary for privileged administration
Fail secure
A failure preserves restricted access even if usability is reduced
Data at rest
Information stored on disk or other media
Data in transit
Information moving over a network
Data in use
Information actively processed in memory
DLP
Monitoring and blocking unauthorized sensitive-data movement
Tokenization
Substitutes sensitive data with a mapped surrogate token
Masking
Hides portions of sensitive information for display or testing
Classification
Labels data according to sensitivity and handling needs
RTO
Target maximum time to restore a service
RPO
Target maximum age of lost data after recovery
Full backup
Copies all selected data
Incremental backup
Copies changes since the most recent backup of any type
Differential backup
Copies changes since the most recent full backup
High availability
Design intended to minimize service interruption
3-2-1 backup rule
Three copies, two media types, one off-site copy
Quick self-check
5 practice questions in our own words. Pick an answer to see the explanation. Practice only: it doesn't predict exam results.
A company runs its own operating system on a cloud virtual machine (IaaS). Who usually patches that guest OS? Obj. 3.1
Show answer
A. The cloud customer. In IaaS, the provider runs the physical hardware and virtualization layer. The customer manages the guest OS and everything on it.
Where should a public-facing web server usually go? Obj. 3.2
Show answer
B. In a screened subnet (DMZ). A screened subnet separates internet-facing systems from sensitive internal networks, with tightly limited traffic between them.
A sensitive field is replaced with a stand-in value, and the real value can only be looked up in a protected vault. What is this called? Obj. 3.3
Show answer
B. Tokenization. Tokenization swaps the real value for a token and keeps the mapping somewhere protected. Masking just hides part of the value on display.
A system has an RPO of 10 minutes. What does that number describe? Obj. 3.4
Show answer
A. The most data (in time) you can afford to lose. RPO is about data loss measured in time. RTO is about how long recovery takes.
You need backups that copy only what changed since the last FULL backup. Which type is that? Obj. 3.4
Show answer
B. Differential. Differential backups copy everything changed since the last full backup. Incremental backups copy changes since the last backup of any type.
Official exam details, objectives and pricing: CompTIA Security+ (official page) (opens in new tab).
NeonKey isn't affiliated with or endorsed by CompTIA. Security+ is a trademark of CompTIA. No pass guarantees — check CompTIA for current exam details.