Skip to content

Menu

ExamPassoLog in

CompTIA Security+ Security Architecture Summary

Checked 10/29/26

Security Architecture: key points

  • A hot site can take over almost immediately; a cold site has space and power but little else.
  • RTO is how fast you must recover; RPO is how much data you can afford to lose.
Importance
★★★☆☆ (3 / 5)
Weight
About 16 of 90 Security+ (SY0-701) questions (18%)

Security implications of cloud, on-premises, virtualization, IoT, ICS/SCADA, and infrastructure as code; secure network design and placement of devices; data types and protection methods; and resilience, backups, and recovery sites.

📖 See more Security Architecture concepts →

Security Architecture: 10 sample questions

Practice questionReviewedSecurity+ (SY0-701) › Security Architecture★★★★☆

Question 1. In which cloud service model does the provider deliver complete, ready-to-use software, such as web email?

  1. ① SaaS (Software as a Service)
  2. ② On-premises
  3. ③ IaaS (Infrastructure as a Service)
  4. ④ PaaS (Platform as a Service)
▼ Show answer and explanation▲ Hide answer and explanation

Answer: ① SaaS (Software as a Service)

Key point: Finished software over the internet = SaaS

In SaaS, the provider runs everything and the customer just uses the application. The customer still manages its own users and data.

Wrong choices

  • IaaS (Infrastructure as a Service): IaaS gives virtual servers, storage, and networks that the customer manages.
  • PaaS (Platform as a Service): PaaS gives a platform for customers to build and run their own apps.
  • On-premises: On-premises systems are run in the company's own facility, not by a cloud provider.
Practice questionReviewedSecurity+ (SY0-701) › Security Architecture★★★★☆

Question 2. Where should a company's public web server usually be placed so outside users can reach it without exposing the internal network?

  1. ① Directly on an employee's laptop
  2. ② In a screened subnet (DMZ)
  3. ③ On the same network as the HR database
  4. ④ Inside the internal network with no firewall
▼ Show answer and explanation▲ Hide answer and explanation

Answer: ② In a screened subnet (DMZ)

Key point: Public-facing servers = screened subnet (DMZ)

A screened subnet (DMZ) is a separate network zone between the internet and the internal network. Public servers sit there, and firewalls control traffic in both directions.

Wrong choices

  • On the same network as the HR database: That would let attackers who reach the web server get close to sensitive data.
  • Directly on an employee's laptop: Laptops are not suitable public servers.
  • Inside the internal network with no firewall: This would expose the internal network.
Practice questionReviewedSecurity+ (SY0-701) › Security Architecture★★★★☆

Question 3. Which backup site has power, network connections, and equipment ready with current data, so it can take over almost immediately?

  1. ① Hot site
  2. ② Mobile site
  3. ③ Warm site
  4. ④ Cold site
▼ Show answer and explanation▲ Hide answer and explanation

Answer: ① Hot site

Key point: Ready almost immediately = hot site

A hot site is a fully equipped duplicate with current data. A warm site needs some setup, and a cold site has only space and basic utilities.

Wrong choices

  • Cold site: A cold site has space and power but little or no equipment.
  • Warm site: A warm site has some equipment but needs time and data to be ready.
  • Mobile site: A mobile site is a portable facility that still needs setup.
Practice questionReviewedSecurity+ (SY0-701) › Security Architecture★★★★☆

Question 4. Under the shared responsibility model for IaaS, who is usually responsible for patching the guest operating system on a virtual machine?

  1. ① The internet service provider
  2. ② The hardware manufacturer
  3. ③ The cloud provider
  4. ④ The customer
▼ Show answer and explanation▲ Hide answer and explanation

Answer: ④ The customer

Key point: IaaS: customer patches the guest OS

In IaaS, the provider is responsible for the physical data center, hardware, and virtualization layer. The customer manages the guest OS, applications, and data.

Wrong choices

  • The cloud provider: In IaaS the provider secures the physical hosts and hypervisor, but the guest OS belongs to the customer.
  • The internet service provider: The ISP does not manage the customer's servers.
  • The hardware manufacturer: The manufacturer does not patch customer operating systems.
Practice questionReviewedSecurity+ (SY0-701) › Security Architecture★★★★☆

Question 5. Which device is placed inline and can block malicious traffic as it is detected?

  1. ① Syslog server
  2. ② Intrusion prevention system (IPS)
  3. ③ Intrusion detection system (IDS)
  4. ④ Network tap
▼ Show answer and explanation▲ Hide answer and explanation

Answer: ② Intrusion prevention system (IPS)

Key point: Inline and blocks = IPS; watches and alerts = IDS

An IPS sits in the traffic path and can stop attacks. An IDS usually receives a copy of traffic and only alerts.

Wrong choices

  • Intrusion detection system (IDS): An IDS watches and alerts but does not block traffic by itself.
  • Network tap: A tap copies traffic for monitoring; it does not block.
  • Syslog server: A syslog server collects logs.
Practice questionReviewedSecurity+ (SY0-701) › Security Architecture★★★★☆

Question 6. Remote employees need an encrypted connection to the company network over the internet. Which technology is designed for this?

  1. ① VPN
  2. ② VLAN
  3. ③ DNS
  4. ④ NAT
▼ Show answer and explanation▲ Hide answer and explanation

Answer: ① VPN

Key point: Encrypted tunnel over the internet = VPN

A VPN creates an encrypted tunnel across an untrusted network so remote users can safely reach internal resources. IPsec and TLS are common VPN protocols.

Wrong choices

  • VLAN: A VLAN separates traffic inside a local network; it does not encrypt internet connections.
  • NAT: NAT translates addresses; it does not encrypt.
  • DNS: DNS resolves names to addresses.
Practice questionReviewedSecurity+ (SY0-701) › Security Architecture★★★★☆

Question 7. Data being sent from a laptop to a web server is in which state?

  1. ① Data in transit
  2. ② Data in use
  3. ③ Data in archive
  4. ④ Data at rest
▼ Show answer and explanation▲ Hide answer and explanation

Answer: ① Data in transit

Key point: Moving across a network = data in transit

Data has three states: at rest (stored), in transit (moving over a network), and in use (being processed). TLS protects data in transit.

Wrong choices

  • Data at rest: Data at rest is stored on a disk or other storage.
  • Data in use: Data in use is being processed in memory.
  • Data in archive: Archived data is stored data, a form of data at rest.
Practice questionReviewedSecurity+ (SY0-701) › Security Architecture★★★★☆

Question 8. A business says it can lose no more than 4 hours of data in a disaster. Which metric does this describe?

  1. ① Mean time between failures (MTBF)
  2. ② Recovery point objective (RPO)
  3. ③ Mean time to repair (MTTR)
  4. ④ Recovery time objective (RTO)
▼ Show answer and explanation▲ Hide answer and explanation

Answer: ② Recovery point objective (RPO)

Key point: Maximum acceptable data loss = RPO

RPO is the maximum amount of data, measured in time, that can be lost. Backups must run at least this often. RTO is how fast systems must be back online.

Wrong choices

  • Recovery time objective (RTO): RTO is how quickly service must be restored, not how much data may be lost.
  • Mean time between failures (MTBF): MTBF is the average time a device works before failing.
  • Mean time to repair (MTTR): MTTR is the average time to fix something.
Practice questionReviewedSecurity+ (SY0-701) › Security Architecture★★★★☆

Question 9. A system must be back online within 2 hours after an outage. Which metric is this?

  1. ① Recovery point objective (RPO)
  2. ② Annualized rate of occurrence (ARO)
  3. ③ Recovery time objective (RTO)
  4. ④ Mean time between failures (MTBF)
▼ Show answer and explanation▲ Hide answer and explanation

Answer: ③ Recovery time objective (RTO)

Key point: Maximum time to restore = RTO

RTO is the target time to restore a service after a disruption.

Wrong choices

  • Recovery point objective (RPO): RPO is how much data can be lost.
  • Mean time between failures (MTBF): MTBF measures reliability, not a recovery target.
  • Annualized rate of occurrence (ARO): ARO is how often a risk is expected each year.
Practice questionReviewedSecurity+ (SY0-701) › Security Architecture★★★★☆

Question 10. A full backup runs on Sunday, and differential backups run Monday through Saturday. Data is lost on Thursday. What is needed to restore?

  1. ① Sunday's full backup and every differential from Monday to Wednesday
  2. ② Only Wednesday's differential
  3. ③ Only Sunday's full backup
  4. ④ Sunday's full backup and Wednesday's differential
▼ Show answer and explanation▲ Hide answer and explanation

Answer: ④ Sunday's full backup and Wednesday's differential

Key point: Differential restore = last full + latest differential

A differential backup copies all changes since the last full backup. To restore, you need the last full backup plus the most recent differential. Incremental backups would need the full backup plus every incremental after it.

Wrong choices

  • Sunday's full backup and every differential from Monday to Wednesday: Each differential already contains all changes since the full backup, so only the latest is needed.
  • Only Wednesday's differential: A differential needs the full backup it is based on.
  • Only Sunday's full backup: That would miss all changes made Monday to Wednesday.

Test yourself.

Security Architecture: 5 questions →Security+ (SY0-701): 5 questions →

Written by AI · Not yet reviewed by staff