CoreQ Academy2.1 Given a scenario, analyze requirements to design resilient systems.
Resilient design places each security component where it works best and builds availability, integrity and recoverability into the architecture.
Component placement and configuration
- Firewall
- At trust boundaries and between segments; default deny with explicit allows.
- Intrusion prevention system (IPS)
- Inline at chokepoints where it can block; consider fail-open vs fail-closed.
- Intrusion detection system (IDS)
- Out of band via taps or SPAN where traffic converges.
- Vulnerability scanner
- Positioned with network reach to all targets, with credentials for depth.
- Virtual private network (VPN)
- Terminates in a controlled zone, ideally with posture checks.
- Network access control (NAC)
- At the access layer to check device identity and health before granting access.
- Web application firewall (WAF)
- In front of web apps, often at the CDN or load balancer.
- Proxy
- Forward proxies for outbound web control and logging.
- Reverse proxy
- Fronts internal servers, terminates TLS, hides origin details.
- Application programming interface (API) gateway
- Central point for API authentication, rate limiting, validation and logging.
- Taps
- Hardware devices that copy traffic passively for monitoring.
- Collectors
- Systems that gather logs or flow data for central analysis.
- Content delivery network (CDN)
- Edge caching and DDoS absorption in front of origins.
Availability and integrity design considerations
- Load balancing
- Distributes load and removes failed nodes.
- Recoverability
- Designing so systems can be restored quickly and correctly.
- Interoperability
- Components work together using open standards, avoiding brittle integrations.
- Geographical considerations
- Distributing across regions for disaster resilience and data residency.
- Vertical vs. horizontal scaling
- Bigger nodes versus more nodes; horizontal scaling improves resilience.
- Persistence vs. non-persistence
- Persistent systems keep state; non-persistent (immutable, rebuilt from images) systems reset to a known-good state and limit attacker persistence.
Check your understanding
Loading quiz…
Original CoreQ Academy material, mapped to objective 2.1 of the publicly available CompTIA SecurityX CAS-005 exam objectives (Exam objectives V5, document version 7.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.