Security+ SY0-701 Domain 3: Security Architecture — 9 practice questions with answers

Domain 3 is 18% of the CompTIA Security+ (SY0-701) exam, which works out to roughly 16of the up to 90 questions on the real test. Below are study notes for the domain's objectives, then every question from our free Security+ SY0-701 practice test that targets this domain, with the correct answer and the reasoning behind it. Try to answer each one before reading the explanation.

Objectives in this domain

• 3.1 Compare and contrast security implications of different architecture models
• 3.2 Given a scenario, apply security principles to secure enterprise infrastructure
• 3.3 Compare and contrast concepts and strategies to protect data
• 3.4 Explain the importance of resilience and recovery in security architecture

What to focus on

Architecture questions ask what changes when the environment changes. In the cloud the shared responsibility model decides who patches what: the customer does more in IaaS and less in SaaS. Containers, serverless, microservices, IoT, ICS/SCADA and embedded systems each bring their own weak points, such as container escape, an unpatchable controller or a device with a hard-coded password.

Objective 3.2 is about placing controls: where a firewall, IPS, proxy, load balancer, jump server or sensor belongs, whether a device should fail open or fail closed, and which secure protocol replaces an insecure one. Data protection (3.3) covers data states (at rest, in transit, in use), classification labels, and the techniques that go with them: encryption, hashing, tokenization, masking and obfuscation, plus data sovereignty and geographic restrictions.

Resilience (3.4) is where the recovery vocabulary lives: high availability and clustering, hot, warm and cold sites, geographic dispersion, backup types and frequency, snapshots, journaling, UPS and generators, and testing methods from tabletop exercises to failover tests. Be ready to pick the cheapest option that still meets a stated recovery requirement.

Practice questions and explanations

1. 1. Which network security device inspects traffic at the application layer and can make decisions based on the content of the traffic?

   1. A) Packet-filtering firewall
   2. B) Web Application Firewall (WAF)
   3. C) Network switch
   4. D) Load balancer

   Answer: B — Web Application Firewall (WAF)

   A Web Application Firewall (WAF) operates at Layer 7 (application layer) of the OSI model. It inspects HTTP/HTTPS traffic and can detect and block application-layer attacks such as SQL injection, XSS, and other OWASP Top 10 vulnerabilities by analyzing the content and patterns of web requests.

2. 2. An organization deploys a network with separate segments for HR, Finance, and Engineering departments. Which security principle does this implement?

   1. A) Data masking
   2. B) Network segmentation
   3. C) Tokenization
   4. D) Data classification

   Answer: B — Network segmentation

   Network segmentation divides a network into multiple segments or subnets, each acting as its own network. This limits lateral movement by attackers, contains breaches, improves monitoring, and allows for more granular access control policies between departments.

3. 3. Which of the following provides the MOST secure method for connecting remote employees to the corporate network?

   1. A) Remote Desktop Protocol (RDP) over the internet
   2. B) VPN with IPSec or SSL/TLS encryption
   3. C) SSH tunneling to a web proxy
   4. D) Unencrypted HTTP access to internal resources

   Answer: B — VPN with IPSec or SSL/TLS encryption

   A VPN (Virtual Private Network) using IPSec or SSL/TLS encryption creates a secure, encrypted tunnel between the remote user's device and the corporate network. This protects data in transit from interception and ensures that only authenticated and authorized users can access internal resources.

4. 4. Which cloud service model gives the customer the MOST control over the underlying infrastructure?

   1. A) Software as a Service (SaaS)
   2. B) Platform as a Service (PaaS)
   3. C) Infrastructure as a Service (IaaS)
   4. D) Function as a Service (FaaS)

   Answer: C — Infrastructure as a Service (IaaS)

   Infrastructure as a Service (IaaS) provides the most control to the customer, including virtual machines, storage, and networking. The customer manages the OS, applications, and data, while the cloud provider manages the physical infrastructure. SaaS gives the least control, and PaaS falls in between.

5. 5. An organization wants to ensure that if one security control fails, other controls will still protect the system. Which concept does this describe?

   1. A) Single point of failure elimination
   2. B) Defense in depth
   3. C) Risk avoidance
   4. D) Incident response

   Answer: B — Defense in depth

   Defense in depth (also called layered security) implements multiple layers of security controls so that if one layer fails, others still provide protection. This includes physical, technical, and administrative controls working together to create redundant security layers.

6. 6. What is the primary purpose of a DMZ (Demilitarized Zone) in network architecture?

   1. A) To provide a wireless guest network
   2. B) To host public-facing services while isolating the internal network
   3. C) To store encrypted backup data
   4. D) To connect two geographic sites via VPN

   Answer: B — To host public-facing services while isolating the internal network

   A DMZ is a perimeter network segment that sits between the external internet and the internal private network. It hosts public-facing services like web servers, email servers, and DNS servers while providing an additional layer of isolation to protect the internal network from direct exposure to the internet.

7. 7. Which encryption approach encrypts data before it is written to storage?

   1. A) Encryption in transit
   2. B) Encryption at rest
   3. C) End-to-end encryption
   4. D) Transport Layer Security

   Answer: B — Encryption at rest

   Encryption at rest protects data that is stored on disk, databases, or other storage media. The data is encrypted before being written to storage and decrypted when read, protecting against unauthorized access to the physical storage media, such as stolen hard drives or unauthorized database access.

8. 8. An organization uses containerized applications deployed in Kubernetes. Which security concern is MOST specific to this environment?

   1. A) SQL injection in web forms
   2. B) Container escape and image vulnerability management
   3. C) Physical security of server rooms
   4. D) Social engineering of employees

   Answer: B — Container escape and image vulnerability management

   Container-specific security concerns include container escape (breaking out of the container to access the host), vulnerabilities in container images, insecure container configurations, and inadequate orchestration security. Image scanning, runtime protection, and proper Kubernetes RBAC are essential container security practices.

9. 9. Which protocol is used to securely automate the issuance and renewal of SSL/TLS certificates?

   1. A) SNMP
   2. B) ACME (Automated Certificate Management Environment)
   3. C) LDAP
   4. D) RADIUS

   Answer: B — ACME (Automated Certificate Management Environment)

   ACME (Automated Certificate Management Environment) is a protocol for automating interactions between certificate authorities and web servers, enabling automatic issuance, renewal, and revocation of SSL/TLS certificates. Let's Encrypt is the most well-known CA that uses the ACME protocol.

Reading answers is not the same as recalling them. When you have worked through every domain, take the timed Security+ SY0-701 practice test: it shuffles the questions and options and scores you by domain, so you can see whether this one still needs work.