Security+ level · Domain 3.0 Security Architecture · 18% of the mapped exam

3.1 Compare and contrast security implications of different architecture models.

31 topics · 5 quiz questions

Every architecture choice moves risk around. Cloud shifts some work to the provider, containers change how you patch, IoT adds devices you cannot harden. Security has to understand each model's trade-offs.

Cloud

Responsibility matrix: Defines which security tasks belong to the provider and which to the customer. In IaaS you secure the OS and up; in SaaS the provider handles most, but you still own data and access.
Hybrid considerations: Mixing on-premises and cloud means consistent identity, networking and monitoring across both, plus secure connectivity between them.
Third-party vendors: Cloud services depend on providers and their partners; their security becomes part of yours.

Architecture and infrastructure concepts

Infrastructure as code (IaC): Defining infrastructure in version-controlled files (Terraform, CloudFormation). Repeatable and reviewable, but a bad template spreads mistakes everywhere.
Serverless: Run code as functions without managing servers. Smaller OS attack surface; focus shifts to function permissions, code and event inputs.
Microservices: Applications built from small independent services communicating over APIs. Better isolation but more APIs and service identities to secure.
Physical isolation: Separating systems physically so there is no network path.
Air-gapped: A network with no connection to other networks, used for very sensitive systems. Still vulnerable to removable media and insiders.
Logical segmentation: Separating traffic with VLANs, subnets and firewall rules on shared hardware.
Software-defined networking (SDN): Network control is centralised in software, separating control plane from data plane. Agile, but the controller becomes a critical target.
On-premises: You own and secure everything: hardware, facility, OS and apps. Full control and full responsibility.
Centralized vs. decentralized: Centralised systems are easier to manage and monitor but are single points of failure; decentralised ones are more resilient but harder to govern consistently.
Containerization: Packaging an app with its dependencies to run on a shared OS kernel (Docker). Lightweight, but containers share the host kernel so isolation is weaker than VMs.
Virtualization: Running multiple VMs on one physical host via a hypervisor. Strong isolation; hypervisor security is critical.
IoT: Internet-connected devices (cameras, sensors) often with weak defaults and limited patching. Segment them.
Industrial control systems (ICS)/supervisory control and data acquisition (SCADA): Systems controlling physical processes (power, water, manufacturing). Availability and safety come first; often legacy and hard to patch.
Real-time operating system (RTOS): An OS that guarantees response within strict time limits, found in vehicles, medical and industrial devices. Often minimal security features.
Embedded systems: Computers built into devices for a specific function; limited resources and update capability.
High availability: Designing systems to stay up through failures using redundancy and failover.

Considerations

Availability: Will the design stay up when needed?
Resilience: Can it withstand and recover from failures or attacks?
Cost: Upfront and ongoing costs, including security tools and staff.
Responsiveness: How quickly the system responds to users and demand.
Scalability: Ability to grow or shrink with demand.
Ease of deployment: How simply and consistently it can be rolled out.
Risk transference: Moving some risk to another party, such as a cloud provider or insurer.
Ease of recovery: How quickly you can restore after an incident.
Patch availability: Whether and how quickly fixes are released.
Inability to patch: Some systems (ICS, embedded, legacy) cannot be patched; they need compensating controls.
Power: Power needs and constraints, especially for embedded and remote devices.
Compute: Processing capacity; low-power devices may not support strong encryption or agents.

Check your understanding

< 2.5 previous 3.2 next >

Original CoreQ Academy material, mapped to objective 3.1 of the publicly available CompTIA Security+ SY0-701 exam objectives (Exam objectives V7, document version 7.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.