Overview
Security Architecture is 18% of the exam and covers designing and securing systems. It has four objectives. Architecture models covers the security implications of different models, cloud, infrastructure as code, serverless, microservices, on-premises, centralized versus decentralized, containerization, virtualization, IoT, operational technology and more. Securing infrastructure covers applying security principles to enterprise infrastructure, including device placement, security zones, firewalls, secure communication and access, and selecting controls. Protecting data covers data types and classifications, data states, and methods such as encryption, masking, tokenization and data loss prevention. Resilience and recovery covers high availability, site considerations, backups, continuity of operations and testing.
The exam rewards understanding the security trade-offs of each architecture, applying principles like zero trust and segmentation to infrastructure, choosing the right data protection method, and designing for resilience. This domain turns the concepts from Domain 1 into secure designs.
How it's tested
Security+ questions in this domain describe an architecture, infrastructure, data or resilience need and ask which secure design or method applies. Security+ questions are vendor-neutral and scenario-based, with some performance-based, so read the situation and choose the security concept, control or response it points to before answering.
-
Architecture implication
An architecture model is described, and you identify its security implication or trade-off.
-
Secure the infrastructure
An infrastructure need is described, and you apply zones, segmentation, firewalls or secure access.
-
Protect the data or design resilience
A data-protection or availability need is described, and you choose the method or resilience design.
An organization must let analysts work with production data for testing without exposing real customer identifiers, while keeping the data usable. Encrypting the whole dataset makes it unusable for analysis, and deleting fields loses utility. Data masking replaces sensitive values with realistic but fictional ones, preserving format and usability while protecting the real identifiers, which is the data-protection method the exam expects for using data safely in non-production contexts.
Domains 4
Official domains from the CompTIA outline, in outline order.
3.1 Compare and contrast security implications of different architecture modelsCloud, serverless, microservices, IoT, OT and more.
- What it means
- This covers the security implications of architecture models: cloud responsibility models and third-party vendors, infrastructure as code, serverless, microservices, network infrastructure including physical isolation, software-defined networking and SD-WAN, on-premises versus centralized and decentralized, containerization, virtualization, IoT, industrial control and operational technology, and high availability.
- What to understand
- Each architecture has distinct security implications: cloud shifts responsibility per the shared model, IoT and OT often lack strong built-in security, microservices expand the attack surface with many services, and virtualization and containers introduce isolation concerns. Understanding the trade-offs of each model is the design-level skill tested.
- How it shows up
- An architecture is described, and you must identify its security implication or trade-off.
- Common confusion
- Confusing the security implications of similar models, such as serverless with containerization, or misjudging IoT and OT security.
3.2 Apply security principles to secure enterprise infrastructureDevice placement, zones, firewalls and secure access.
- What it means
- This covers applying security principles to infrastructure: device and security control placement, security zones, attack surface reduction, connectivity, failure modes (fail-open versus fail-closed), network appliances such as firewalls, proxies and IPS, port security, and secure communication and access including VPNs and selecting effective controls.
- What to understand
- Securing infrastructure means placing controls where they are effective, segmenting into zones, reducing the attack surface, choosing appropriate failure modes, and securing access with VPNs and strong authentication. Applying principles like least privilege, segmentation and defense in depth to the physical and network design is the tested skill.
- How it shows up
- An infrastructure security need is described, and you must apply zones, segmentation, the right appliance or secure access.
- Common confusion
- Confusing fail-open with fail-closed, or misplacing security controls relative to the zones they protect.
3.3 Compare and contrast concepts and strategies to protect dataData types, classifications, states and protection methods.
- What it means
- This covers protecting data: data types and classifications such as regulated, confidential and public, data states (at rest, in transit, in use), data sovereignty and geolocation, and methods such as encryption, hashing, masking, tokenization, obfuscation, segmentation and data loss prevention.
- What to understand
- Protecting data starts with classifying it and knowing its state, then applying the right method: encryption for confidentiality at rest and in transit, masking and tokenization to use data without exposing the real values, and data loss prevention to stop exfiltration. Choosing the right method for the data and its use is the key skill.
- How it shows up
- A data-protection need is described, and you must choose the classification, state consideration or protection method.
- Common confusion
- Confusing masking, tokenization and encryption, or the data states at rest, in transit and in use.
3.4 Explain the importance of resilience and recovery in security architectureHigh availability, backups and continuity.
- What it means
- This covers resilience and recovery: high availability including load balancing and clustering, site considerations (hot, warm, cold and geographic dispersion), platform diversity, continuity of operations, capacity planning, testing such as tabletop exercises and failovers, backups, and power resilience such as UPS and generators.
- What to understand
- Resilience keeps systems available through failures using redundancy, high availability and recovery sites, while recovery restores service after an incident using backups and continuity plans. Testing validates that these work. Designing for resilience and recovery, matched to the organization's objectives, is the architectural skill expected.
- How it shows up
- A resilience or recovery need is described, and you must choose the high-availability, site or backup approach.
- Common confusion
- Confusing high availability with backups, or the recovery site types hot, warm and cold.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Cloud responsibility model
Security duties split between provider and customer.
- Remember
- Shifts with the service model.
- Tested as
- Architecture questions.
- Trap
- Applying one split to all services.
-
IoT and OT security
Often weak built-in security.
- Remember
- Needs compensating controls.
- Tested as
- Architecture questions.
- Trap
- Assuming strong default security.
-
Microservices attack surface
Many services expand exposure.
- Remember
- More components to secure.
- Tested as
- Architecture questions.
- Trap
- Overlooking the expanded surface.
-
Security zones
Segmenting the network by trust.
- Remember
- Place controls between zones.
- Tested as
- Infrastructure questions.
- Trap
- Misplacing controls.
-
Fail-open vs. fail-closed
Allow versus block on failure.
- Remember
- Choose by safety and security need.
- Tested as
- Infrastructure questions.
- Trap
- Confusing the two.
-
Data states
At rest, in transit, in use.
- Remember
- Protect each state appropriately.
- Tested as
- Data questions.
- Trap
- Confusing the states.
-
Data classification
Regulated, confidential, public and more.
- Remember
- Drives the protection applied.
- Tested as
- Data questions.
- Trap
- Not classifying data.
-
Masking vs. tokenization
Hide values versus substitute with tokens.
- Remember
- Use data without exposing real values.
- Tested as
- Data questions.
- Trap
- Confusing the two.
-
Data loss prevention
Stops sensitive data exfiltration.
- Remember
- Monitors and blocks data leaving.
- Tested as
- Data questions.
- Trap
- Overlooking DLP.
-
High availability
Keeping systems up through failures.
- Remember
- Load balancing and clustering.
- Tested as
- Resilience questions.
- Trap
- Confusing with backups.
-
Recovery sites
Hot, warm and cold by readiness.
- Remember
- Hot is ready, cold needs setup.
- Tested as
- Recovery questions.
- Trap
- Confusing the site types.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Masking vs. tokenization vs. encryption
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Masking | Replace with realistic fake values | Usable, non-reversible display | Confusing with tokenization |
| Tokenization | Substitute with a token mapped elsewhere | Real value stored securely apart | Confusing with masking |
| Encryption | Reversible with a key | Protects confidentiality | Confusing with masking |
Data states
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| At rest | Stored data | Encrypt on disk | Confusing with in transit |
| In transit | Moving over a network | Encrypt the connection | Confusing with at rest |
| In use | Being processed | Hardest to protect | Overlooking it |
High availability vs. backups
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| High availability | Stays up through failures | Redundancy and failover | Confusing with backups |
| Backups | Restores data after loss | Recovery point | Relying on them for uptime |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Encrypt data for analysis
- What candidates pick
- Encrypt an entire dataset so analysts can test with it safely.
- Why it looks right
- Encryption protects data.
- Why it's wrong
- Encryption makes the data unusable for analysis; masking replaces sensitive values with realistic fakes while keeping the data usable.
Clue to watch for Data must stay usable while hiding real sensitive values.
-
IoT is secure by default
- What candidates pick
- Assume IoT or OT devices have strong built-in security.
- Why it looks right
- They are modern devices.
- Why it's wrong
- IoT and OT often have weak built-in security, so compensating controls such as segmentation are needed.
Clue to watch for The architecture includes IoT or operational technology.
-
HA replaces backups
- What candidates pick
- Rely on high availability instead of backups to recover from data corruption.
- Why it looks right
- HA keeps systems running.
- Why it's wrong
- High availability handles component failure but replicates corruption too; backups are needed to recover lost or corrupted data.
Clue to watch for Data has been lost or corrupted, not just a component failed.
-
Fail-open for security
- What candidates pick
- Configure a security control to fail-open so traffic continues during a failure.
- Why it looks right
- It avoids downtime.
- Why it's wrong
- Fail-open allows traffic through on failure, which can be a security risk; fail-closed blocks it. The choice depends on safety versus security needs.
Clue to watch for The requirement is to maintain security during a control failure.
-
Cloud shifts all responsibility
- What candidates pick
- Assume the cloud provider secures everything in the customer's environment.
- Why it looks right
- The provider manages the cloud.
- Why it's wrong
- The shared responsibility model splits duties; the customer still secures their data, access and configuration depending on the service model.
Clue to watch for The question concerns who secures what in the cloud.
Answer framework
For any Domain 3 scenario, use these steps to find the answer Security+ expects.
- Identify whether the need is an architecture implication, securing infrastructure, protecting data, or resilience and recovery.
- For architectures, reason about the security trade-offs of the model, such as the cloud responsibility split or weak IoT and OT security.
- For infrastructure, apply zones, segmentation and least privilege, place controls effectively, choose the right failure mode, and secure access.
- For data, classify it and its state, then choose encryption, masking, tokenization or data loss prevention to fit the use.
- For resilience, design high availability and recovery sites and backups matched to the recovery objectives, and test them. Where two options seem to fit, pick the one that most precisely matches the scenario's requirement.
Practice question
Want more like this? The Security+ practice test has questions for every domain.
Checklist
0 of 10
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Approach this domain as turning the concepts of Domain 1 into secure designs. Start with architecture models and their security implications, since the exam tests trade-offs: the cloud shared responsibility split, the weak default security of IoT and OT, and the expanded attack surface of microservices. Then learn to secure infrastructure by applying zones, segmentation and least privilege, placing controls effectively, and choosing failure modes and secure access.
Next, master data protection: classify data and its state, and keep masking, tokenization and encryption distinct, since they are easily confused and commonly tested. Finally, learn resilience and recovery, distinguishing high availability (staying up) from backups (recovering data) and the recovery site types.
Because this domain is about design reasoning, practice scenario questions that ask for the best secure design rather than a definition. Because Security+ rewards applied understanding across a broad field, use scenario practice questions and relate each concept to a real situation rather than only memorizing lists, and review missed practice questions by domain to find weak spots. Afterwards, move to Domain 4, Security Operations.
FAQ
How much of Security+ is Domain 3?
Security Architecture is 18% of the exam, focused on designing and securing systems and data.
What is the difference between masking and tokenization?
Masking replaces sensitive values with realistic but fictional data so the dataset stays usable without exposing real values. Tokenization substitutes a value with a token, storing the real value securely elsewhere and mapping back only when authorized.
What are the three data states?
Data at rest (stored), data in transit (moving over a network), and data in use (being processed). Each state needs appropriate protection, and the exam expects you to distinguish them.
What is the difference between high availability and backups?
High availability keeps systems running through component failures using redundancy and failover. Backups restore data after loss or corruption. High availability can replicate corruption, so backups are still needed.
Why are IoT and OT a security concern?
Internet of Things and operational technology devices often have weak or no built-in security and are hard to patch, so they require compensating controls such as network segmentation to reduce their risk.
What is the difference between fail-open and fail-closed?
Fail-open allows traffic to continue if a control fails, prioritizing availability. Fail-closed blocks traffic on failure, prioritizing security. The right choice depends on whether safety or security matters more in that context.
How does Domain 3 connect to the rest of the exam?
It applies the concepts from Domain 1 to design systems that resist the threats of Domain 2, which are then operated and monitored in Domain 4 and governed in Domain 5.
Other Networking certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 3 knowledge
You have covered architecture models, securing infrastructure, data protection and resilience. Test whether you can choose the right secure design under exam conditions.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the Security+ AI tutor Get any concept explained your way