Study Hub / CompTIA Security+ (SY0-701) / Domain 3.0
CompTIA Security+ (SY0-701) Domain 3.0: Security Architecture — Explained
Domain 3.0 is about how secure systems are designed: the protocols that protect traffic, the virtualization that changed the data center, the cloud models that changed everything else, and the resilience thinking that keeps it all running when pieces fail.
3.1 — Secure protocols
Protocols are the agreed languages devices speak. The "secure" versions of common protocols exist because the originals sent everything in plaintext — anyone watching the wire could read it all.
- HTTPS (port 443) — HTTP wrapped in TLS. Encrypts the entire web session: the page content, the form you submit, the cookies that identify you.
- SSH (port 22) — encrypted remote shell, replacing Telnet (port 23), which sent passwords in the clear.
- SFTP / FTPS — secure file transfer. SFTP runs over SSH; FTPS is FTP with TLS layered on. Both replace plaintext FTP (ports 20/21).
- SNMPv3 — network monitoring with authentication and encryption. SNMPv1 and v2c used community strings ("public"/"private") sent in plaintext — effectively no security at all.
- LDAPS (port 636) — LDAP over TLS for directory lookups; plain LDAP (389) leaks credentials and queries.
- DNSSEC — adds cryptographic signatures to DNS answers so resolvers can verify the response is genuine, not spoofed.
3.2 — Virtualization and cloud concepts
Virtualization decouples software from hardware: a hypervisor lets one physical machine run many virtual machines, each believing it owns the hardware.
- Type 1 (bare-metal) hypervisors — run directly on hardware (VMware ESXi, Hyper-V). Used in data centers.
- Type 2 (hosted) hypervisors — run as an app on an OS (VirtualBox, VMware Workstation). Used for labs and testing.
- Containers — share the host OS kernel instead of virtualizing hardware. Lighter and faster to start than VMs, but with weaker isolation between workloads.
- Virtual networking — virtual switches, virtual NICs, and virtual firewalls recreate network topology in software.
Cloud builds on virtualization with three service models — a core cloud question:
- IaaS — rent the infrastructure (VMs, storage, networks). You manage the OS and apps. Example: EC2.
- PaaS — rent the platform (runtime, database, OS handled for you). You deploy code. Example: Heroku, Azure App Service.
- SaaS — rent the finished software. You just use it. Example: Gmail, Salesforce.
3.3 — Resilience and redundancy
Resilience is designing so that failures are expected events, not emergencies. The vocabulary:
- High availability (HA) — systems stay up through component failure, usually via clustering or failover pairs.
- Redundancy — duplicate critical components: dual power supplies, RAID disks, multiple ISP links. No single point of failure.
- Load balancing — spreading traffic across servers so no one server is overwhelmed — and so one can die unnoticed.
- Backups: full, incremental, differential — full copies everything; incremental copies only what changed since the last backup of any kind (fast backup, slow restore); differential copies what changed since the last full (slower backup, faster restore).
- RAID levels — RAID 1 mirrors (redundancy, no speed gain), RAID 5 stripes with parity (one disk can fail), RAID 6 double parity (two disks can fail), RAID 10 mirrors + stripes (fast and redundant, costs half your disks).
- RTO and RPO — Recovery Time Objective (how fast you must be back) and Recovery Point Objective (how much data you can afford to lose).
3.4 — Infrastructure and data considerations
The last objective ties architecture to the data it protects:
- Data classification — labeling data (public, internal, confidential, restricted) so protections match sensitivity. Classification drives everything downstream: encryption, access, retention.
- Encryption at rest vs. in transit vs. in use — data on disk, data on the wire, and data in memory each need different protections.
- Data sovereignty — some data legally can't leave a country or region, which constrains where cloud workloads can run.
- Secure baselines and hardening — starting from a known-good configuration: unnecessary services disabled, default credentials changed, patches applied.
- Decommissioning — data must be destroyed when hardware retires: wiping, degaussing, or physical destruction, matched to the data's classification.
The must-memorize table: plaintext protocols and their secure replacements
One table, high value: know what replaced what.
| Plaintext protocol | Port | Secure replacement |
|---|---|---|
| HTTP | 80 | HTTPS (443) — HTTP over TLS |
| Telnet | 23 | SSH (22) — encrypted remote shell |
| FTP | 20/21 | SFTP (over SSH) or FTPS (FTP over TLS) |
| LDAP | 389 | LDAPS (636) — LDAP over TLS |
| SNMP v1/v2c | 161 | SNMPv3 — auth + encryption |
| DNS | 53 | DNSSEC — signed, verifiable answers |
| SMTP | 25 | SMTPS / STARTTLS — encrypted mail transport |
Try it: 4 sample questions
Sample questions to check your understanding of this domain. Answers and full reasoning are tucked under each one.
1. An administrator needs to replace Telnet access to network switches. Which protocol should they deploy, and why?
- A. A. HTTPS, because it encrypts web traffic on port 443
- B. B. SSH, because it provides an encrypted remote shell on port 22
- C. C. SFTP, because it encrypts file transfers over port 22
- D. D. SNMPv3, because it encrypts management traffic
Show answer & reasoning
B. Telnet sends everything — including passwords — in plaintext. SSH is its direct encrypted replacement: an interactive remote shell on port 22. SFTP (C) does run over SSH, but it transfers files; the need here is interactive switch administration. SNMPv3 (D) is for monitoring, not shell access.
2. A company moves its customer database to a SaaS CRM. Under the shared responsibility model, who is now responsible for patching the database servers?
- A. A. The customer, because data ownership never transfers
- B. B. The SaaS provider, because infrastructure and platform are their responsibility
- C. C. Both equally, as with all cloud models
- D. D. Nobody — SaaS applications never need patching
Show answer & reasoning
B. In SaaS, the provider manages everything below the application — servers, OS, database engine, patching. The customer's responsibility shrinks to their data, user accounts, and access configuration. That shrinking line of customer responsibility is the whole point of the shared responsibility model.
3. A backup strategy needs the fastest possible nightly backups, and restore speed is a secondary concern. Which method fits?
- A. A. Full backup every night
- B. B. Incremental backup nightly after one full backup
- C. C. Differential backup nightly after one full backup
- D. D. RAID 6 across the backup targets
Show answer & reasoning
B. Incremental backups copy only what changed since the last backup of any kind, so each nightly run is tiny and fast. The tradeoff — slower restores, since you replay the full plus every incremental — is acceptable here because the requirement prioritizes backup speed. Differential (C) is the middle ground; full (A) is slowest nightly. RAID (D) is disk redundancy, not a backup method.
4. A file server holds data classified as "restricted." It is being decommissioned. Which destruction method is appropriate?
- A. A. Reformatting the drives and reinstalling the OS
- B. B. Degaussing or physical destruction of the drives
- C. C. Moving the data to a cloud archive first
- D. D. Deleting the file shares and disabling the accounts
Show answer & reasoning
B. "Restricted" is the highest sensitivity tier — simple deletion or reformatting (A, D) leaves recoverable data on the platters. Degaussing (for magnetic media) or physical destruction guarantees the data cannot be recovered. The destruction method must match the classification: the more sensitive the data, the more certain the destruction.
This was one domain. The simulator drills all 5.
This free preview covered Security Architecture (Domain 3.0, 18%). Not covered here: Threats, Vulnerabilities & Mitigations (Domain 2.0, 22%); Security Operations (Domain 4.0, 28%). The two highest-weight domains — hands-on threat scenarios, incident response, and security operations — stay in the paid guide and practice bank. The ByteBar Practice Exam Simulator drills every domain with 1,000 exam-style questions — $9.99 one-time unlocks all 28 exams. Prefer to read? The full Security+ Study Guide is in the ByteBar shop on Etsy.
Practice Exam Simulator — $9.99 one-time, all 28 exams Full Study Guides on EtsyWant reps? Try the free Security+ quiz.