CompTIA Security+ Security Architecture Syllabus

Security Architecture syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Security Architecture in CompTIA Security+, not a summary of it.

1. 1

   Architecture Models

   6 topics

   • Cloud Architecture
     • Responsibility matrix and shared responsibility
     • Hybrid considerations and third-party vendors
   • Infrastructure as Code and Serverless
     • Infrastructure as code (IaC)
     • Serverless and microservices
   • Network Infrastructure Models
     • Physical isolation and air-gapped networks
     • Logical segmentation and SDN
   • On-Premises, Centralized, and Decentralized
     • Trade-offs in availability and cost
     • Containerization and virtualization
   • IoT, ICS/SCADA, Embedded, and RTOS Considerations
   • Architecture Considerations and Trade-offs
     • Availability, resilience, and cost
     • Responsiveness, scalability, and ease of deployment
     • Risk transference, patch availability, power, and compute
2. 2

   Securing Enterprise Infrastructure

   5 topics

   • Infrastructure Design Considerations
     • Device placement and security zones
     • Attack surface and connectivity
     • Failure modes: fail-open vs fail-closed
   • Device Operation Modes
     • Active vs passive monitoring
     • Inline vs tap/monitor
   • Network Appliances
     • Jump server and proxy server
     • IPS/IDS and load balancer
     • Sensors
   • Firewall and Port Security
     • Web application firewall (WAF) and next-gen firewall
     • Unified threat management (UTM) and layer 4/7 firewalls
     • 802.1X and EAP
   • Secure Communication and Access
     • VPN and remote access
     • Tunneling: TLS and IPSec
     • SD-WAN and SASE
3. 3

   Protecting Data

   3 topics

   • Data Types and Classifications
     • Regulated, trade secret, intellectual property, legal, financial
     • Sensitive, confidential, public, restricted, private, critical
   • Data Considerations
     • Data states: at rest, in transit, in use
     • Data sovereignty and geolocation
   • Methods to Secure Data
     • Geographic restrictions
     • Encryption, hashing, masking, tokenization
     • Obfuscation, segmentation, permission restrictions
4. 4

   Resilience and Recovery

   7 topics

   • High Availability
     • Load balancing vs clustering
   • Site Considerations
     • Hot, cold, and warm sites
     • Geographic dispersion
   • Platform Diversity and Multi-Cloud Systems
   • Continuity of Operations and Capacity Planning
     • People, technology, infrastructure
   • Testing
     • Tabletop exercises and failover
     • Simulation and parallel processing
   • Backups
     • Onsite/offsite and frequency
     • Encryption, snapshots, replication
     • Journaling
   • Power Resilience
     • Generators
     • Uninterruptible power supply (UPS)

Security Architecture flashcards for CompTIA Security+

21 of 60 cards from the Security Architecture deck — real questions with worked answers.

1. In cloud computing, what is the 'shared responsibility model'?

   A framework dividing security duties between the cloud provider (security OF the cloud — physical, host, infrastructure) and the customer (security IN the cloud — data, identity, configuration, applications).

2. Compare IaaS, PaaS, and SaaS in terms of customer security responsibility.

   IaaS: customer secures OS, apps, and data (most responsibility). PaaS: provider manages OS/runtime; customer secures apps and data. SaaS: provider manages nearly everything; customer mainly secures data and access (least responsibility).

3. What is Infrastructure as Code (IaC)?

   Defining and provisioning infrastructure through machine-readable configuration files/templates rather than manual processes, enabling consistent, repeatable, version-controlled, and automated deployments.

4. What security benefit does Infrastructure as Code provide over manual provisioning?

   It reduces configuration drift and human error by enforcing consistent, immutable, version-controlled deployments that can be reviewed, tested, and audited before being applied.

5. What is serverless computing (Function as a Service)?

   A cloud model where the provider dynamically manages server allocation and the customer runs code as event-triggered functions, paying only for execution time without managing underlying servers.

6. What is a key security concern unique to serverless architectures?

   Reduced visibility/control over the underlying environment and an expanded attack surface from many small functions and event triggers; security shifts toward securing function code, permissions, and dependencies.

7. What is Software-Defined Networking (SDN)?

   A network architecture that separates the control plane (decision-making) from the data plane (traffic forwarding), allowing centralized, programmable network management.

8. What is a Software-Defined Wide Area Network (SD-WAN)?

   A virtual WAN architecture that uses software to intelligently route traffic across multiple connection types (MPLS, broadband, LTE), often used to securely connect branch offices to cloud resources.

9. What is Secure Access Service Edge (SASE)?

   A cloud-delivered model that converges networking (SD-WAN) and security functions (CASB, SWG, ZTNA, FWaaS) into a single service delivered at the network edge, close to users.

10. Compare centralized and decentralized computing architectures.

    Centralized concentrates processing/control in one location (easier management/security, single point of failure). Decentralized distributes processing across multiple nodes (resilient, scalable, but harder to manage and secure consistently).

11. What is a key trade-off of on-premises infrastructure versus cloud?

    On-premises gives full control and data residency but requires high capital cost and in-house maintenance; cloud offers scalability and lower upfront cost but reduces direct control and relies on the provider.

12. What is SCADA in the context of industrial systems?

    Supervisory Control and Data Acquisition — a system used to monitor and control industrial processes (utilities, manufacturing) across large geographic areas, a subset of ICS.

13. What is an Industrial Control System (ICS)?

    A general category of control systems (including SCADA, DCS, PLCs) used to operate and automate industrial and critical infrastructure processes.

14. Why are ICS/SCADA systems often difficult to secure?

    They use legacy hardware/protocols, prioritize availability and uptime over patching, have long lifecycles, often can't be taken offline for updates, and were historically designed without security in mind.

15. What is a Real-Time Operating System (RTOS)?

    An OS designed to process data and respond to inputs within strict, deterministic time constraints, used in embedded and time-critical systems like medical devices, automotive, and industrial controllers.

16. What is an embedded system?

    A dedicated computer system built into a larger device to perform specific functions (e.g., firmware in appliances, medical devices, vehicles), often with limited resources and difficult to patch.

17. What are common security challenges of IoT devices?

    Weak/default credentials, infrequent or absent patching, limited compute for security controls, insecure protocols, and large numbers of devices expanding the attack surface.

18. What does the 'responsiveness' architecture consideration refer to?

    How quickly a system reacts to inputs/events — critical for RTOS and ICS where delayed responses can cause safety failures, sometimes prioritized over added security controls.

19. Define the architecture trade-off between availability and security controls.

    Adding security controls (patching, segmentation, inspection) can introduce downtime or latency; high-availability environments may delay or limit controls to maintain uptime, increasing risk.

20. What is network segmentation and why is it used?

    Dividing a network into isolated zones/subnets to limit lateral movement, contain breaches, reduce attack surface, and apply tailored security policies per segment.

21. What infrastructure design factor is described as 'ease of recovery'?

    How simply and quickly a system can be restored after failure — influenced by backups, redundancy, documentation, and automation; a key design consideration balancing cost and resilience.

See more Security Architecture flashcards →

Planning Security Architecture for CompTIA Security+

Security Architecture (CompTIA Security+) FAQ