CompTIA Security+ SY0-701: Security Architecture-Vol 3

Cloud computing is a model for ubiquitous, on-demand network access to a pool of configurable resources. NIST and ISO/IEC 17788 provide a framework with cloud characteristics, service and deployment models.

Trace the evolution from on-premises IT to cloud models, including iaas, paas, and saas. Explore serverless, containers, and edge computing as modern architectures, highlighting efficiency, scalability, and security challenges.

Understand vendor versus customer security responsibilities across IaaS, PaaS, and SaaS, and how shared responsibility shifts from infrastructure to data and access controls.

Explore how misconfigurations under the shared responsibility model led to Capital One’s data breach, and learn that customers, not providers, secure firewall rules and data access.

Explore data protection in hybrid deployments, detailing encryption at rest, in transit, and in use, plus access control, data classification, backups, and monitoring to secure the CIA triad.

Assess cloud vendor security, enforce strong contracts and SLAs, limit access, and ensure encryption, audits, and incident response to mitigate supply chain and regulatory risks like GDPR and HIPAA.

Define and enforce contractual security requirements and SLAs with cloud vendors, covering encryption, access controls, breach timelines, uptime, incident response, data recovery, retention, exit clauses, monitoring, and renewal terms.

Monitor vendor security in cloud environments with dashboards, logs, alerts, and automated monitoring; audit controls via questionnaires and external reports to enforce contracts and SLAs and manage fourth-party risk.

Adopt secure coding practices for infrastructure definitions by version controlling iac templates in git, performing peer reviews, validating inputs, and baking security settings, least privilege, and secret management into templates.

Validate infrastructure as code by scanning configuration files for misconfigurations and vulnerabilities, integrate scans into CI/CD, and apply policy as code and secret detection to prevent exposure.

Explore serverless computing: a cloud model where the provider manages infrastructure, enabling reduced attack surface, automatic scaling, and ephemeral execution, while facing visibility, insecure dependencies, event injection, and permission challenges.

Master function isolation in serverless apps by running each function in its own secure container, limiting blast radius, while enforcing permission boundaries and least privilege with RBAC and resource policies.

Discover how monitoring and logging provide visibility in serverless environments. Learn to collect, aggregate, and standardize logs and metrics, apply distributed tracing and alerts, and manage privacy and cost.

An API gateway acts as the front door for a microservices app, enforcing authentication, authorization, rate limiting, traffic inspection, SSL termination, logging, and policy enforcement to support zero-trust security.

Understand container security considerations, including secure container images and image scanning, isolation and secure sandboxing, network policies, secrets management, runtime monitoring, and hardened host systems.

Explore the evolution of network security architectures from perimeter-based firewalls to defense in depth, zero-trust, and software-defined networks, with emphasis on continuous verification, segmentation, and cloud and hybrid environments.

Apply defense-in-depth strategies to protect networks with security: firewall, intrusion detection and prevention systems, endpoint protection, network segmentation, identity and access management, monitoring and logging, encryption, DLP, and user training.

Explore physical network separation as a robust security measure, creating independent, air-gapped networks for classified data, industrial control, finance, and research, including secure offline backups.

Explore air-gapped systems: physically isolated computers that never connect to the internet, used in national security, critical infrastructure, finance, and forensics to prevent external access.

Implement air-gapped systems with dedicated hardware, strict data transfer controls, one-way data diodes, and rigorous patching, logging, and verification to maintain an isolated, secure environment.

Learn secure data transfer for air-gapped environments using removable media, hashing, encryption, and scanning. Apply procedural controls, logs, custody, two-person rules, and optional data diodes to prevent leakage.

Analyze the Stuxnet case study to see how air-gapped systems can be breached via infected USB devices. Understand air-gap limits, insider risk, and the need for verification.

Segment your network into purposeful boundaries to contain threats, improve visibility, and enforce least privilege. Learn how VLANs enable secure segmentation and compliance with PCI, HIPAA, and other regulations.

Learn how VLANs enable network segmentation and how to mitigate VLAN hopping, native VLAN risks, and inter-VLAN routing through ACLs, firewalls, and port security.

Implement micro-segmentation to create isolated zones and communication rules across workloads, VMs, and cloud services. Use automated discovery and centralized policy engines to prevent lateral movement and harden sensitive data.

Software-defined networking centralizes control with a central controller, enabling dynamic segmentation, automated responses, real-time visibility, and consistent policy enforcement across the network for rapid threat mitigation.

Centralize policy management with the SDN controller to quickly apply consistent security rules across the entire network and implement intent-based networking via a policy engine.

Secure the SDN controller with strong access control and encrypted communications, while maintaining regular patching, vulnerability scanning, redundancy, and audit logs.

Integrate software defined networking with security monitoring systems and SIEM to gain real-time visibility, automate responses, and build baselines for anomaly detection, forensics, and audit-ready compliance.

secure traditional on-prem data centers by enforcing physical access controls, environmental monitoring, redundant power and fire suppression, hardware firewalls, network segmentation, defense in depth, manual patching, and centralized logging.

Explore how on-prem, cloud, and hybrid deployment models shape security controls, from hands-on, hardware-based protections to cloud configuration, integration, and cross-environment monitoring.

Centralized control enforces consistent security policies and faster incident response, with a single source of truth. Yet it creates a point of failure and insider risk, demanding strict access controls.

Explore secure hybrid models blending on-prem data centers with cloud services, securing interconnections with encrypted tunnels, firewalls, and segmentation while enforcing SSO, MFA, and monitoring for data residency and compliance.

Explore container isolation, including namespaces and cgroups, the shared kernel risk of container breakout, and how least privilege, runtime monitoring, and image hardening improve security.

Learn how container orchestration platforms like Kubernetes manage deployment, scale, and security controls such as RBAC, network policies, secrets management, configuration controls, logging, and patch management.

Secure the hypervisor, the central manager of virtual machines, through patching, isolation, and resource controls. Enforce robust admin access with MFA and monitor logs for incident response and compliance.

Explore how virtual machine escape breaks isolation by exploiting hypervisor vulnerabilities. Learn mitigations, including patching, segmentation, hardware-assisted virtualization, hardened configurations, monitoring, and secure defaults.

Explore how virtual networks inside hypervisors use virtual switches, NICs, and routers, and implement security controls like virtual firewalls, microsegmentation, encryption, monitoring, and RBAC to prevent lateral movement.

Explore unique security challenges of IoT deployments, including default credentials, limited update paths, visibility gaps, device authentication, and physical tampering, with best practices for secure IoT ecosystems.

Explore how firmware update mechanisms secure IoT devices, using digitally signed updates, authenticated sources, and encrypted over-the-air delivery, with dual-partition rollback, logging, inventory automation, and regular maintenance.

Explore the unique security requirements of operational technology (OT) systems, emphasizing availability, legacy equipment, and the need for air gaps and strict network isolation to protect lives and infrastructure.

Air-gapped systems isolate networks from the internet, a gold standard for safeguarding critical infrastructure and nuclear plants, while risks from removable media and limited visibility remain.

Apply passive, non-intrusive security monitoring in operational technology environments by analyzing network traffic with taps and anomaly detection to alert and contain threats without disrupting critical processes.

Explore how deterministic, time-sensitive systems demand lightweight, predictable security tested for timing impact. Plan changes carefully, avoid rebooting, and monitor without disrupting critical operations.

Balance security needs with resource limits in embedded and real-time systems. Prioritize lightweight encryption, device-level trust, and external isolation to protect sensors, controllers, and IoT devices.

Protect cryptographic secrets with hardware security modules and trusted platform modules, storing encryption keys securely, enabling secure boot, and preventing exposure of keys during operation in enterprise and cloud environments.

Code signing creates a digital signature with a private key to verify software integrity. Systems use the public key to verify signatures and detect tampering before installation.

Examine memory protection mechanisms that enforce isolation and permissions, including process isolation, read-only regions, stack protection, DEP, ASLR, and privilege separation, with MMU or MPU support in embedded systems.

Redundancy strengthens availability and the CIA triad, while providing mirrored backups and multiple paths, but must be securely implemented with patching, encryption, and synchronized security policies to avoid new risks.

Explore how authentication and authorization secure distributed systems through centralized authentication, SSO, and identity federation, using RBAC or ABAC, OAuth tokens and JWTs, with zero trust and continuous enforcement.

Explains data consistency trade-offs in distributed systems, the CAP theorem, and how choosing between consistency, availability, and partition tolerance affects security and resilience.

Apply a structured security architecture evaluation to define scope, model threats, identify controls, and produce a risk-focused architecture report for secure by design.

Apply a structured risk assessment methodology to architecture decisions by identifying assets, threats, and vulnerabilities, then analyze and mitigate risks with controls such as encryption, access restrictions, and backups.

Explain why architecture decisions and risk tradeoffs were chosen, and document diagrams, controls, risk registers, and change history to support audits and continuous improvement, including PCI DSS and HIPAA.

Balance cost constraints with proportional security by applying risk-informed trade-offs, map the budget to critical controls through risk assessments, and communicate implications to leadership to avoid underprotection.

Explore how scalability shapes security architecture as organizations grow, from automated provisioning and SSO to centralized endpoint management and SIEM, ensuring policy consistency and global coverage.

Embed security into deployment with DevSecOps, automating code scanning, configuration checks, dependency validation, and simulated attacks, using infrastructure as code, baselines, templates, and zero-trust guardrails to balance speed and safety.

Learn how DevSecOps embeds security into every step of development and deployment, using automation, infrastructure as code, policy gates, logging, and cross-team collaboration to secure software.

Automate security controls and validation at scale to enforce policies, enable real-time remediation, and treat security as code within cloud and DevSecOps environments for compliance and faster protection.

Master vendor risk management by assessing third-party data exposure, validating security practices and certifications, and enforcing contractual protections with least privilege and ongoing monitoring.

Design architectures with redundancy, distribution, automation, and real-time data replication to enable faster recovery with low RPO and RTO, even in multi-region cloud deployments.

Define recovery time objectives and design architecture to meet them with resilience. Assess redundancy, automation, cloud options, testing, and cost to ensure quick recovery.

Embed data protection into architecture by classifying data, enforcing encryption, access controls, and backups from design to deployment, and address data in motion, sovereignty, and scalability.

Tailor patching strategies to on-prem, cloud, containers, and virtualization to close vulnerabilities. Leverage automation, testing in staging, and image-based container updates to minimize downtime and secure endpoints and integrations.

Manage vulnerabilities across on-prem, cloud, containers, and IoT with continuous visibility, prioritization, and remediation, using cloud-compatible scanners, container image scans, and centralized vulnerability platforms.

Examine how patching failures sparked major security incidents, from Equifax's 2017 breach to WannaCry, and learn a vulnerability management approach with patch testing, prioritization, automation, and metrics.

Navigate how resource constraints shape security decisions in small clinics and similar settings, balancing performance with risk-based, lightweight protections, log management, and user awareness.

Protect availability and integrity during power outages by deploying UPS, backup generators, and automatic transfer switches, while implementing graceful shutdowns and real-time monitoring to safeguard security devices and data.

Design security around network choke points—gateways, firewalls, VPN concentrators, or routers—for centralized monitoring, then place sensors and logging to detect threats and monitor east-west traffic into a sim.

secure rooms and access controls prevent hands-on breaches to servers and network hardware. enforce endpoint protections with encryption, screen locks, remote wipe, and USB port controls.

Define and segment networks into external, DMZ, internal, and secure zones based on trust and function, with boundaries enforced by firewalls and ACLs to contain breaches.

Internal segmentation moves security inward by dividing the network into trusted zones and using VLANs. It enforces least privilege, contains threats, and monitors traffic with firewalls and access control lists.

Map the environment to identify attack vectors and exploitable entry points. Apply a systematic methodology to assess exposure and conduct ongoing vulnerability assessments and penetration testing.

Map the attack surface by identifying hardware, software, networks, APIs, endpoints, and cloud services, then continuously assess with tools like Nmap, Nessus or OpenVAS, OWASP ZAP, Burp Suite, and EASM.

Learn how to secure data in transit by enforcing confidentiality, integrity, and authenticity through TLS and HTTPS, certificates, key management, and internal encryption, with secure protocols like SFTP and SSH.

Secure cloud connectivity enforces encrypted TLS traffic and strong identity controls across on-premises and cloud environments. It emphasizes least privilege, monitoring, and protected APIs for multi-cloud setups.

Explore how system failures become security events, weighing fail-open and fail-closed choices, while preserving visibility and secure authentication to maintain logging and resilient recovery.

Document a failure handling plan with defined roles and step-by-step procedures to protect security during outages. Implement communication, logging, escalation, and post-incident reviews to restore services quickly and prevent recurrence.

Define explicit failure responses at the design stage for every component, implement redundancy or monitoring for fail-closed or fail-open modes, and verify with controlled testing and detailed logs.

Select security devices by aligning threats with device types such as IDS/IPS and web application firewall, and by placement at perimeter or internally, while balancing performance, scalability, integration, and compliance.

Design deployment architecture by aligning security devices with network topology, inline or out-of-band deployment, and segmentation to ensure visibility, performance, and centralized management across hybrid environments.

Compare passive IDS and inline active IPS, noting observation versus action, where passive devices monitor and alert while active devices block in real time, with tradeoffs in latency and reliability.

Monitoring acts as the security nervous system, collecting logs and alerts from IDS, SIEM, firewalls, and cloud-native tools to reveal threats, but faces volume, visibility gaps, and false positives.

Integrate monitoring tools with incident response to turn detections into decisive action, enabling automated containment, forensic capture, and real-time, well-documented incident logging across shared protocols.

Compare passive security systems, such as intrusion detection systems and network taps, with active systems like intrusion prevention and next-gen firewalls, highlighting benefits, limitations, and defense-in-depth balancing visibility and prevention.

Security controls impose a performance cost across latency, CPU and memory, encryption, monitoring, and network impact; design and configure for balance, scalability, and seamless user experience.

Learn to anticipate the consequences of system failures through failure impact analysis, mapping dependencies, and aligning security, operations, and business impact with resilient failover strategies.

Jump servers act as a single, hardened gateway, centralizing access to internal systems and enabling segmentation, logging, and role-based access control for enhanced security.

Explore how reverse proxies shield internal servers, provide isolation, enable load balancing, terminate SSL/TLS, filter threats, cache content, enable centralized authentication, and log activity for secure, fast access.

Discover how content filtering screens web pages, downloads, emails, and queries using forward and reverse proxies to block, redirect, or log threats, enforce acceptable use, and prevent data leaks.

Integrate authentication into network security appliances to verify identities, enable single sign-on, and enforce role-based access, with centralized logging for compliance and auditing.

Tune intrusion detection rules to reduce false positives and alert fatigue. Apply whitelisting, severity scoring, machine learning, regular feedback, and cross-team collaboration to distinguish real threats from benign activity.

Tune and optimize IDS and IPS by adjusting rules, thresholds, and sensitivity to reduce alert noise, ensure actionable alerts, and continuously improve detection with ML and human validation.

Integrate intrusion detection and prevention with security operations and SIEM to move from alarms to automated, coordinated responses within a security operations center, enhancing visibility, incident response, and threat hunting.

Compare IDS and IPS, explain detection versus prevention, in-line versus out-of-band deployment, tuning risks, and how many systems offer both for layered security.

Decide between IDS and IPS deployment by weighing passive monitoring against in-line prevention. Explore network taps and span ports, monitor-only testing, and considerations for uptime, performance, and alerts.

Implement a hybrid approach by blending ids and ips to maximize protection and visibility, placing each system where it performs best.

Position load balancers between users and servers to hide internal structures, offload SSL/TLS, centralize encryption, monitor health, and enable edge protections such as rate limiting and WAF integration.

Explore session persistence, or sticky sessions, routing requests to a backend server behind a load balancer. Assess security concerns like session hijacking, encryption, secure cookies, and expiration.

Strengthen security and availability by implementing health monitoring that automatically checks back-end servers, detects compromised or failing systems, and triggers alerts before issues spread.

Collect and aggregate security data from networks, endpoints, and applications to turn logs into actionable intelligence; standardize, correlate, and securely store information for real-time alerts and forensic analysis.

Mac address filtering relies on a list, is spoofable, offers no encryption or authentication, and is limited to small networks or IoT as a layer alongside 802.1X or certificate-based authentication.

Strengthen layer 2 security by implementing DHCP snooping and dynamic ARP inspection to validate the DHCP binding table and block rogue servers and ARP spoofing.

Explore the three core 802.1X components—the supplicant, authenticator, and authentication server—and how their handshake via EAPOL and Radius secures access with NAC and device posture.

configure the supplicant for 802.1x by selecting authentication method, provisioning credentials or certificates, validating certificates, and enabling automated, centralized testing and rollout to ensure secure network access.

Integrate the authentication server into 802.1x by connecting a RADIUS server to the identity store and PKI, and enforce access policies, posture checks, and NAC for secure network access.

Isolate guest access from the corporate network with a dedicated VLAN or subnet. Implement lightweight authentication, controlled gateways, and firewall rules to restrict traffic and monitor usage.

Compare 802.1x EAP types from EAP TLS, P-E-A-P, EAP TTLS, to EAP MD5 and EAP Fast, highlighting certificate use, password security, mutual authentication, and deployment trade-offs for secure network authentication.

Set up 802.1x infrastructure, RADIUS, and PKI for EAP-TLS, PEAP, and EAP-FAST. Configure clients and supplicants, enforce policies, enable logging, and integrate NAC for posture-based access.

Balance strong security and wide compatibility when selecting an EAP method, ensuring devices, servers, and operating systems support the chosen method and perform secure authentication.

Trace the evolution of firewalls from packet-filtering to stateful inspection and NGFWs. Understand application-level gateways, deep packet inspection, and cloud-based firewall services protecting data across on-prem, cloud, and remote endpoints.

Design firewall deployments with perimeter, DMZ, and internal segmentation to balance security and performance. Ensure cloud, hybrid, and on-premises environments have centralized management and high availability.

Explore cloud-based, appliance, and integrated web application firewall deployments, each with trade-offs in control and simplicity, and choose options that fit your organization's size, regulatory needs, resources, and risk tolerance.

Manage and tune web application firewall rules to balance security and usability, starting from default sets like the OASP core rule set and adapting to evolving traffic.

Integrate the web application firewall into the development workflow to align security with Agile and DevOps, collaborating early and automating WAF updates in CI/CD.

Unified threat management combines multiple security layers into one platform, integrating firewall, IDS/IPS, antivirus, web filtering, email protection, and VPN management to simplify management and strengthen protection.

Explore management complexity in unified threat management by mapping policies, logs, and updates, and apply strategic practices to balance security with usability through documentation and automation.

See how a small business strengthens its security posture with a unified threat management system, centralizing firewall, antivirus, web filtering, and VPN to enable secure remote access.

Explore how next-generation firewalls extend traditional filtering with deep packet inspection and application awareness. Integrate IPS, user identity, threat intelligence, SSL inspection, and centralized analytics.

Next generation firewalls deliver application-aware, layer 7 inspection and user-based policies with directory service integration. They combine threat intelligence, deep packet inspection, sandboxing, and IPS in a centralized, policy-driven platform.

Threat intelligence turns next-generation firewalls into dynamic defenders by using real-time threat feeds, indicators of compromise, and automated updates to block new threats and prioritize responses.

Understand the OSI model's seven layers and how security controls at levels—from physical protection and VLANs to IPsec, ACL, and application defenses like WAFs, SSL, and TLS, forming defense-in-depth network.

Compare layer 4 and layer 7 filtering to balance security and performance, examining throughput, latency, deep inspection trade-offs, and how a hybrid approach, hardware accelerators, and streamlined rules optimize networks.

Examine evasion techniques attackers use to bypass layer 4 and layer 7 defenses—port manipulation, protocol tunneling, and encryption abuse—and apply layered mitigations with normalisation, behavioural analysis, and SSL inspection.

Select encryption protocols by use case, leveraging TLS for web and email, IPsec for VPNs. Use SSH for remote admin, while avoiding legacy SSL and weighing performance and compliance.

Manage digital certificates end-to-end, including issuance by trusted certificate authorities, renewal, and revocation. Automate discovery and monitoring with CMS and PKI, enforcing SHA-256, strong keys, and modern TLS.

Protect past communications with perfect forward secrecy using ephemeral session keys unique to each session. DHE or ECDHE exchanges ensure server's long-term private keys cannot decrypt earlier traffic if compromised.

Select and configure secure communication protocols such as TLS, IPsec, and SFTP/SSH. Ensure strong cipher suites, certificate validation, and mutual authentication while considering PCI DSS, HIPAA, GDPR compliance.

Compare site-to-site and remote access vpn types and explain how ipsec, ikev2, ssl/tls, and l2tp shape security, performance, and deployment considerations, including authentication and split tunneling.

Compare ssl tls and ipsec VPN implementations, highlighting data-in-transit encryption, ease of use via port 443, vs ipsec's end-to-end security and site-to-site capabilities.

Authentication integration connects systems to a central identity provider, enabling single sign-on, MFA enforcement, and consistent access policies across cloud and on-premises resources.

Design secure, scalable VPN architectures that connect remote users and sites with encrypted tunnels, robust authentication, and NAC, incorporating ipsec, ssl, tls, ikev2, and cloud integration.

Assess device posture to verify security health before granting network access, leveraging NAC, MDM, and EDR to enforce zero-trust policies for BYOD and VPN connections.

Analyze a hybrid-work VPN breach where password-only access enabled attacker entry, emphasizing the need for multi-factor authentication, device posture checks, session monitoring, geolocation checks, IP reputation, and network segmentation.

Explore tunneling protocols used to secure remote network access, including IPsec, SSL/TLS VPNs, L2TP, and GRE, and address encryption, authentication, and detection of protocol tunneling threats.

implement tls correctly by adopting tls 1.3, disabling older versions, and selecting strong cipher suites like aes-256 or ChaCha20 with SHA-256, while enabling forward secrecy and robust certificate management.

Explain how encapsulation wraps data with protocol headers for secure VPN and IPSec tunneling. Mitigate risks by enforcing encryption, selecting the right mode, inspecting traffic, and validating configurations.

Explore header manipulation attacks and defenses: spoofing, CRLF injection, and protections like IPsec, DMARC, SPF, DKIM, deep packet inspection, and zero-trust segmentation.

Compare tunneling protocols like IPsec, SSL/TLS, GRE, L2TP, and WireGuard to secure data over untrusted networks. Align protocol choice with use case, NAT/firewall considerations, and performance needs.

Enforce TLS 1.2 and 1.3, disable older versions, and guard against protocol downgrade attacks to secure the handshake and reduce metadata exposure; verify configurations with SSL Labs and testssl.sh.

Identify how TLS cipher suites determine encryption, authentication, and integrity in connections. Configure servers to remove weak ciphers, enable forward secrecy, and prefer AES-GCM with TLS 1.3-friendly settings.

Validate transport layer security certificates by checking validity periods, trusted authorities, domain name, and the full chain from leaf to root, plus revocation status via ocsp stapling.

Centralize security management to unify policies, monitoring, and reporting across cloud, on-prem, and endpoints, ensuring policy consistency and automated enforcement with SIEM integration.

Centralized security management consolidates control across on-prem, cloud, SaaS, and endpoints to improve visibility, enforce policies, speed threat detection, and streamline incident response.

Achieve policy consistency across Azure, AWS, private clouds, and remote devices with centralized standards, automation, and continuous monitoring to ensure uniform IAM, logging, and incident response.

Centralize visibility through monitoring and reporting integration using SIEMs to detect threats across endpoints, cloud, and on-premise systems, enabling rapid, automated responses and audit-ready reporting.