Security Architecture and Design
This chapter covers how to design resilient, defensible systems and networks. You will learn foundational principles like zero trust, defense in depth, and least privilege, along with segmentation, cloud models, and virtualization. Good architecture makes attacks harder and limits damage when defenses fail.
Core Design Principles
Security architecture rests on a small set of durable principles that lower risk regardless of the specific technology in use, and SY0-701 expects you to apply them to scenarios rather than merely define them. The most important modern concept is zero trust, which abandons the idea of a trusted internal network and instead verifies every request by identity, device posture, and context, even inside the perimeter. The exam breaks zero trust into a control plane and a data plane. The control plane includes the policy engine that makes access decisions, the policy administrator that carries them out, and adaptive identity, threat scope reduction, and secured zones. The data plane includes the policy enforcement point that actually allows or blocks the connection, plus the subject or system requesting access and its implicit trust zones. Defense in depth layers independent controls so that no single failure causes a breach; each layer backs up the others, combining physical, technical, and administrative measures. Least privilege grants only the minimum access a role needs, shrinking the attack surface and limiting the blast radius of a compromised account. Least functionality applies the same idea to systems, running only required services and disabling unnecessary ports, protocols, and software. Implicit deny rejects anything not explicitly permitted, the default posture of a well-built firewall rule set. You should also weigh control types and their functions, because the exam pairs them constantly: control types are technical, managerial, operational, and physical, while control functions are preventive, deterrent, detective, corrective, compensating, and directive. A compensating control substitutes for a primary control that cannot be implemented, and a directive control instructs people through policy. Separation of duties splits a sensitive task so no one person can complete it alone, and mandatory vacations or job rotation surface hidden fraud. Secure and default configurations, hardened baselines, and secure-by-design thinking build protection in from the start rather than bolting it on later. Applying these principles consistently produces systems that resist compromise, contain incidents when they occur, and give defenders time to detect and respond.
Network Segmentation and Zones
Dividing a network into controlled zones limits how far an attacker can move after gaining a foothold, turning a single compromised host into a contained event rather than a full breach. Segmentation separates systems into zones using VLANs, subnets, and firewalls so that a compromise in one area cannot spread freely into another; enforcing policy at the boundaries between zones is what gives segmentation its value. A screened subnet, historically called a DMZ, places public-facing servers such as web and mail systems in an isolated zone protected by filtering on both sides, so that a breach of an internet-exposed server does not directly expose the internal network. Microsegmentation pushes this idea to the finest grain, applying per-workload policies that permit only the specific flows an application needs; it is a key enabler of zero trust in data centers and cloud environments. An air gap physically isolates the most critical networks, such as industrial control or classified systems, from untrusted networks, removing remote attack paths altogether, though data still crosses via removable media, which becomes the control point. A jump server, or bastion host, funnels all administrative access into sensitive segments through a single hardened and heavily monitored system, giving defenders one choke point to log and defend. The exam also expects familiarity with the devices and design choices that shape these boundaries: firewalls, including next-generation and web application firewalls, that filter by port, protocol, application, and content; proxies that broker and inspect traffic; and the placement of sensors and appliances inline versus out of band, and in active fail-open versus fail-closed modes. Network access control checks device posture before granting a port, and 802.1X authenticates devices at the switch. Out-of-band management keeps administrative traffic off the production data path. Software-defined networking centralizes policy and makes segmentation programmable. When you read a scenario, ask which zone each asset belongs in, what should be allowed to cross, and where a monitored choke point would catch lateral movement.
Cloud and Virtualization
Modern architectures depend on cloud services and virtualization, which change where security responsibilities lie and introduce failure modes that on-premises designs never had. The three service models set the boundary of customer control: infrastructure as a service gives the customer the most control and the most responsibility, securing the operating system, applications, and data; platform as a service shares responsibility, with the provider managing the runtime; and software as a service shifts most responsibility to the provider, leaving the customer accountable mainly for data, identity, and configuration. The shared responsibility model formalizes this split and is a frequent exam target: the provider secures the underlying infrastructure, and the customer secures what they place on top, so a misconfigured storage bucket or an over-permissive identity policy is the customer's fault, not the provider's. Deployment models include public, private, hybrid, and community clouds, each trading control against cost and convenience. Virtualization runs multiple isolated virtual machines on one physical host through a hypervisor; a type 1 or bare-metal hypervisor runs directly on hardware, while a type 2 hypervisor runs atop a host operating system. Hardening the hypervisor is critical because a VM escape that breaks isolation would compromise every guest, and resource reuse must be handled so data does not leak between tenants. Containers package an application with its dependencies and share the host kernel, making them lighter and faster than VMs but giving weaker isolation, so a kernel vulnerability can affect all containers on a host. Serverless and function-as-a-service designs remove server management but demand careful control of permissions and third-party dependencies. Sandboxing runs untrusted code in an isolated environment for safe analysis. The exam also covers infrastructure as code, which defines environments in version-controlled templates for consistent and auditable deployment; software-defined networking and orchestration; and cloud-specific risks such as insecure APIs, unmanaged sprawl, and identity misconfiguration. Understanding these models prevents the dangerous misconfigurations that cause most cloud breaches.
Resilience and Availability
Availability is one of the three pillars of the CIA triad, so architecture must be designed to keep services running through failures and attacks, and SY0-701 tests the specific mechanisms that deliver resilience. Redundancy duplicates critical components so that no single point of failure causes an outage; you should recognize redundancy at multiple levels, including redundant power through uninterruptible power supplies and generators, redundant network paths and internet links, RAID for disk fault tolerance, and geographic redundancy across sites and cloud regions and availability zones. Failover automatically shifts workloads to a standby when the primary fails and must be tested regularly, because untested failover often fails when it is actually needed. Load balancing distributes traffic across multiple servers to improve performance and to tolerate the loss of individual nodes, and it pairs naturally with clustering for high availability. High availability combines redundancy and failover to meet uptime targets, often expressed in nines, for the services a business cannot afford to lose. The exam connects these mechanisms to recovery planning: capacity planning for people, technology, and infrastructure; backups with attention to onsite versus offsite storage, frequency, encryption, and, crucially, restoration testing; and replication that keeps copies current. Site resilience options range from hot sites that can take over almost immediately at the highest cost, to warm sites that need some setup, to cold sites that are cheap but slow to activate. Platform diversity and multi-vendor strategies reduce the chance that one flaw takes down everything. Deception and disruption technologies also belong here: honeypots are decoy systems that lure and study attackers, honeynets are networks of them, honeytokens are bait data whose access signals an intrusion, and honeyfiles are planted files that trigger alerts. These divert adversaries from real assets while generating high-fidelity detection. When evaluating a design, ask what a single failure would take down, whether recovery has been tested against defined objectives, and whether the cost of resilience matches the value of the service it protects.
Last updated: September 2026
Luyện tập vẫn miễn phí. Trọn bộ hướng dẫn CompTIA Security+ (SY0-701) là chính phần kiến thức, dạy từ đầu đến cuối — tệp PDF + EPUB tải về, thuộc về bạn.