CompTIA Security+ Security Architecture Syllabus

What infrastructure design factor is described as 'ease of recovery'?

How simply and quickly a system can be restored after failure — influenced by backups, redundancy, documentation, and automation; a key design consideration balancing cost and resilience.

Compare 'fail-open' and 'fail-closed' (fail-secure) device modes.

Fail-open: on failure the device permits traffic/access (favors availability). Fail-closed/fail-secure: on failure it blocks traffic/access (favors security/confidentiality).

What is an active-passive (failover) device configuration?

One device actively handles traffic while a standby device remains idle, taking over only if the active device fails — provides redundancy but underutilizes hardware.

What is an active-active device configuration?

Multiple devices simultaneously handle traffic and share load, providing both redundancy and load balancing, but requiring synchronization and careful capacity planning.

What is a jump server (jump box)?

A hardened, monitored intermediary host used to securely access and administer devices in a separate security zone, reducing direct exposure of sensitive systems.

What is a proxy server and what security benefit does it provide?

An intermediary that forwards client requests; it hides internal addresses, can filter/cache content, enforce policy, and inspect traffic between users and external resources.

What is a load balancer's role in security architecture?

It distributes traffic across multiple servers to improve availability and performance, can perform health checks and SSL/TLS offloading, and helps absorb traffic spikes including some DoS conditions.

What is a Web Application Firewall (WAF)?

A firewall that inspects HTTP/HTTPS traffic at Layer 7 to protect web applications from attacks like SQL injection, XSS, and other OWASP Top 10 threats.

Compare a stateful and a stateless firewall.

Stateful firewalls track the state of active connections and allow return traffic for established sessions. Stateless firewalls filter each packet individually against static rules without connection context.

What is a Next-Generation Firewall (NGFW)?

A firewall that combines traditional packet filtering with deep packet inspection, application awareness, intrusion prevention, and identity-based policies.

What is Unified Threat Management (UTM)?

A single appliance that combines multiple security functions—firewall, IDS/IPS, antivirus, content filtering, VPN—into one consolidated platform.

What is port security on a switch?

A control that restricts which devices can connect to a switch port, often by limiting or binding allowed MAC addresses to prevent unauthorized access and MAC flooding.

What is 802.1X?

A port-based network access control (NAC) standard that authenticates devices/users before granting network access, using a supplicant, authenticator, and authentication server (often RADIUS).

Compare IDS and IPS.

An IDS detects and alerts on suspicious activity (passive, out-of-band). An IPS detects and actively blocks/prevents malicious traffic (inline, in the traffic path).

What is the difference between TLS and IPSec for securing communication?

TLS secures application-layer traffic (e.g., HTTPS) between endpoints; IPSec secures traffic at the network layer and is commonly used to build VPN tunnels protecting all IP traffic.

Compare a full tunnel and a split tunnel VPN.

Full tunnel routes all client traffic through the VPN (more secure, more bandwidth). Split tunnel sends only corporate-bound traffic through the VPN while other traffic goes direct (faster, less secure).

What is the difference between IPSec transport mode and tunnel mode?

Transport mode encrypts only the packet payload (host-to-host). Tunnel mode encrypts the entire original packet and adds a new header (gateway-to-gateway/site-to-site VPN).

What are the four common data classifications in business/government?

Common examples: Public, Private/Internal, Confidential, and Restricted/Critical (government often uses Unclassified, Confidential, Secret, Top Secret).

Distinguish data at rest, data in transit, and data in use.

At rest: stored data (disk/db). In transit: data moving across a network. In use: data being actively processed in memory/CPU. Each requires different protection (encryption, TLS, memory protection).

What is the difference between PII and PHI?

PII (Personally Identifiable Information) is data that can identify an individual (name, SSN). PHI (Protected Health Information) is health-related data tied to an individual, protected under HIPAA.

What is data sovereignty?

The principle that data is subject to the laws and regulations of the country in which it is physically stored or collected, affecting where data may legally reside and be processed.

What is tokenization as a method to secure data?

Replacing sensitive data with a non-sensitive surrogate (token) that has no exploitable value; the mapping is stored securely in a separate token vault, reducing exposure of real data.

Compare masking and encryption for protecting data.

Masking obscures data by replacing it with realistic but fake values (often irreversible, for display/testing). Encryption reversibly transforms data using a key so authorized parties can recover the original.

What is a Hardware Security Module (HSM)?

A dedicated, tamper-resistant hardware device that securely generates, stores, and manages cryptographic keys and performs crypto operations.

What is Data Loss Prevention (DLP)?

A set of tools and processes that detect and prevent unauthorized access, use, or exfiltration of sensitive data across endpoints, networks, and storage.

What does high availability (HA) aim to achieve, and how is it measured?

It ensures systems remain operational with minimal downtime, typically measured in 'nines' of uptime (e.g., 99.999% = 'five nines' ≈ 5 minutes of downtime per year).

Compare a hot site, warm site, and cold site.

Hot site: fully equipped and running, near-instant failover (highest cost). Warm site: partially equipped, needs some setup/data restore (moderate). Cold site: space/power only, longest recovery time (lowest cost).

What is geographic dispersion (geo-redundancy) in site planning?

Distributing systems/data across separate physical locations so a localized disaster (fire, flood, power loss) at one site doesn't take down operations.

What is platform diversity and what risk does it mitigate?

Using different vendors, operating systems, or technologies so a single vulnerability or exploit cannot compromise the entire environment, reducing systemic/monoculture risk.

What is a multi-cloud strategy and one benefit it provides?

Using services from multiple cloud providers; benefits include avoiding vendor lock-in, increasing resilience, and meeting diverse compliance or performance needs.

What is capacity planning, and what three areas does Security+ emphasize?

Ensuring sufficient resources to meet demand and recovery needs; key areas are People (staffing), Technology (compute/storage/bandwidth), and Infrastructure (facilities/power).

Compare RTO and RPO.

RTO (Recovery Time Objective) is the maximum acceptable time to restore a system after an outage. RPO (Recovery Point Objective) is the maximum acceptable amount of data loss measured in time (how far back the last good backup must be).

Compare a full, incremental, and differential backup.

Full: copies all data. Incremental: copies only data changed since the last backup (any type) — fast backup, slower restore. Differential: copies data changed since the last full backup — slower backup, faster restore.

What is the 3-2-1 backup rule?

Keep 3 copies of data, on 2 different types of media, with 1 copy stored offsite, to protect against device failure, site disaster, and ransomware.

Compare tabletop exercises and failover/parallel testing for continuity plans.

Tabletop exercises are discussion-based walkthroughs of the plan (low cost, no disruption). Failover/parallel testing actually activates backup systems to validate real recovery, providing stronger assurance but more risk/cost.

What is the role of a UPS in power resilience?

An Uninterruptible Power Supply provides immediate, short-term battery power during an outage to prevent abrupt shutdown and bridge the gap until generators start or power returns.

Compare a UPS and a generator for power resilience.

A UPS gives instant but short-duration battery power for graceful shutdown/bridging; a generator provides longer-term power for extended outages but takes time to start, so the two are used together.

What is a Power Distribution Unit (PDU) in a data center?

A device that distributes electrical power to racks/equipment, often with monitoring, surge protection, and the ability to manage redundant power feeds.

What is dual power supply / redundant power in HA design?

Equipping critical devices with two independent power supplies fed from separate sources/PDUs so the device keeps running if one supply or feed fails.

What is a containerized architecture and a key security consideration?

Packaging applications with their dependencies into isolated containers sharing a host OS kernel; key concerns include kernel-level isolation weaknesses, insecure images, and securing the orchestration layer (e.g., Kubernetes).