Security+ Domain 3 Study Guide: Security Architecture (SY0-701)
Reach 50,000+ security professionals
Sponsor a newsletter slot and put your brand in front of CISOs, engineers, and IT decision-makers.
Security Architecture is 18% of the Security+ SY0-701 exam and has 4 objectives. This study guide lists each objective with its official title, summarizes the concepts you need in tables, flags the exam traps that cost points, and gives three original practice questions with explanations for every option. The concept tables are our own summaries of standard Security+ topics, and the official CompTIA objectives document is the authority for what is tested.
Domain 3 at a Glance
Security Architecture is 18% of the Security+ SY0-701 exam. It has 4 objectives, listed below with their official titles. The concept tables are our own summaries of standard Security+ topics, and the official CompTIA objectives document is the authority for what is tested.
| Objective | Official title |
|---|---|
| 3.1 | Compare and contrast security implications of different architecture models. |
| 3.2 | Given a scenario, apply security principles to secure enterprise infrastructure. |
| 3.3 | Compare and contrast concepts and strategies to protect data. |
| 3.4 | Explain the importance of resilience and recovery in security architecture. |
Architecture Models and Shared Responsibility
In cloud models, responsibility shifts toward the provider as you move from IaaS to SaaS, but the customer always owns its data and access decisions.
| Model | Provider usually manages | Customer usually manages |
|---|---|---|
| IaaS | Physical hosts, network, virtualization | Operating system, applications, data, access |
| PaaS | Infrastructure, operating system, runtime | Applications, data, access |
| SaaS | Almost everything including the application | Data, user access, configuration |
| Serverless (FaaS) | Servers, runtime, scaling | Function code, dependencies, execution permissions |
Other models to know: infrastructure as code, microservices, containerization, virtualization, software-defined networking, on-premises, hybrid, air-gapped networks, IoT, ICS and SCADA, real-time operating systems and embedded systems.
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.
Securing Infrastructure
| Concept | What to know |
|---|---|
| Security zones and device placement | Place devices by trust level, such as a screened subnet for public servers |
| Failure modes | Fail-open keeps access when a control fails. Fail-closed blocks |
| Active versus passive | Active devices can block. Passive devices only observe |
| Inline versus tap or monitor | Inline sits in the path. A tap copies traffic for analysis |
| Appliances | Jump servers, proxies, load balancers, IDS and IPS, sensors |
| Firewall types | Layer 4, layer 7, web application firewall, UTM, next-generation firewall |
| Secure access | VPN, tunneling with TLS or IPsec, SD-WAN and SASE |
| Port security | 802.1X and EAP control access at the switch port |
Protecting Data
| Topic | Remember |
|---|---|
| Data types | Regulated, trade secret, intellectual property, legal and financial |
| Classifications | Public, private, sensitive, confidential, restricted and critical |
| Data states | At rest (stored), in transit (moving), in use (being processed) |
| Methods | Encryption, hashing, masking, tokenization, obfuscation, segmentation, permission restrictions |
| Sovereignty and geolocation | Where data is stored and which laws apply |
Tokenization swaps a value for a surrogate kept in a vault. Masking hides part of a value. Hashing is one-way.
Resilience and Recovery
| Topic | Remember |
|---|---|
| High availability | Load balancing spreads traffic. Clustering keeps systems ready to take over |
| Recovery sites | Hot is ready now, warm needs some setup, cold is space only |
| Testing | Tabletop exercise, simulation, failover and parallel processing tests |
| Backups | Onsite and offsite, frequency, encryption, snapshots, replication and journaling |
| Power | UPS for immediate battery power, generators for longer outages |
| Capacity planning | People, technology and infrastructure |
| Platform diversity and multi-cloud | Avoid a single point of failure by using different platforms |
Common Exam Traps
These mix-ups cost points in this domain.
What the customer always owns
In every cloud model the customer is responsible for its data and for who can access it.
Tokenization versus masking
Tokenization replaces the value and stores the original in a vault. Masking hides part of the displayed value.
Tabletop versus failover tests
A tabletop is a discussion with no impact on systems. A failover test actually switches to the backup.
Fail-open versus fail-closed
Fail-open favors availability and fail-closed favors security. Pick based on what the scenario protects.
Try It: Three Domain 3 Practice Questions
Answer these before you read the key. They are original questions written to the published objectives, and none are real exam questions.
Question 1. In a serverless (function as a service) deployment, which of the following is a primary security responsibility of the customer?
- A. Patching the host operating system and runtime environment
- B. Securing the function code and assigning least privilege execution roles
- C. Hardening the hypervisor that runs the functions
- D. Controlling physical access to the servers executing the functions
Question 2. Which of the following methods replaces a primary account number with a randomly generated surrogate value and stores the original in a secured vault?
- A. Hashing
- B. Masking
- C. Tokenization
- D. Salting
Question 3. A continuity team gathers in a conference room and verbally walks through a ransomware scenario to discuss roles and decisions. No production systems are touched. Which type of test is this?
- A. Backup restoration test
- B. Tabletop exercise
- C. Parallel processing test
- D. Full failover test
Answer Key and Explanations
Question 1: B. Securing the function code and assigning least privilege execution roles (objective 3.1)
Right: the customer owns the code, its dependencies, and the permissions the function runs with.
- A. Patching the host operating system and runtime environment. Wrong: the provider manages the host OS and runtime in serverless platforms.
- C. Hardening the hypervisor that runs the functions. Wrong: hypervisor hardening is a provider duty.
- D. Controlling physical access to the servers executing the functions. Wrong: physical access control is always handled by the provider.
Question 2: C. Tokenization (objective 3.3)
Right: tokenization substitutes a token and keeps the mapping to the real value in a secure vault.
- A. Hashing. Wrong: hashing produces a one-way digest and does not use a vault to restore originals.
- B. Masking. Wrong: masking hides characters and does not typically keep a vault mapping.
- D. Salting. Wrong: salting adds random data to a value before hashing and is not a substitution scheme.
Question 3: B. Tabletop exercise (objective 3.4)
Right: a tabletop exercise is a discussion-based walkthrough with no impact on systems.
- A. Backup restoration test. Wrong: a restoration test actually restores data from backup media.
- C. Parallel processing test. Wrong: parallel processing runs recovery systems alongside production and involves live systems.
- D. Full failover test. Wrong: a failover test actually moves operations to the secondary system.
How to Study Domain 3
Domain 3 carries 18% of the exam. See our objectives explained for all five domains, the study plan for how to split your days by weight, and the commonly confused terms cheat sheet for the pairs that appear here.
Draw the shared responsibility table
Fill in who manages what for IaaS, PaaS, SaaS and serverless from memory, then check it.
Match recovery terms to scenarios
Write a scenario for each of hot, warm and cold sites and each type of recovery test.
Retry misses on different days
A widely cited review of learning techniques rated practice testing and spaced practice as high utility. Return to the questions you miss a few days later instead of rereading the same pages.
Practice With DD Academy
DD Academy has Security+ flashcards and practice questions for every objective in Domain 3, plus an AI tutor that explains why each option is right or wrong. It is free to start on iPhone and the web.
The bottom line
Know the 4 Domain 3 objectives, learn the concept tables until you can explain each term without notes, watch for the traps listed above and keep practicing with scenario questions across all five domains.
Frequently asked questions
What percentage of Security+ is Domain 3?
Security Architecture is 18% of SY0-701 according to CompTIA, and 19% on SY0-801.
How many objectives are in Domain 3?
Four on SY0-701: 3.1 architecture models, 3.2 securing enterprise infrastructure, 3.3 protecting data and 3.4 resilience and recovery.
What is the customer responsible for in serverless?
The function code, its dependencies and the permissions the function runs with. The provider manages the servers and runtime.
What is the difference between tokenization and masking?
Tokenization replaces a sensitive value with a surrogate token and stores the original in a secured vault. Masking hides part of a value, such as showing only the last four digits.
What is a tabletop exercise?
A discussion-based walkthrough of a scenario in which participants talk through roles and decisions. It does not touch production systems.
What is the difference between a hot, warm and cold site?
A hot site is ready to run with current data, a warm site has equipment but needs data and setup, and a cold site is space with little or no equipment.
Sources & references
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Daily briefings + Google Top Stories in one step.
Enter your email and we'll subscribe you to the daily briefing and add Decryption Digest to your Google Search feed at the same time.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.
