Security Architecture

Designing resilient systems with Zero Trust, cloud security, network architecture, and secure development lifecycle integration.

5 minutes 5 Questions

Security Architecture in CompTIA CASP+ refers to the design and implementation of comprehensive security structures that protect an organization's information systems and data. It encompasses the strategic planning and systematic approach to building secure IT environments aligned with business obj…

Concepts covered
Resilient Systems Design (Scalability, Availability)Zero Trust Architecture PrinciplesSoftware-Defined Networking (SDN)Asset Identification, Management, and AttestationAPI Integration and SecurityCloud Control Strategies (Proactive, Detective, Preventative)Cloud Access Security Broker (CASB)Shared Responsibility ModelCI/CD Pipeline SecurityInfrastructure as Code (Terraform, Ansible)Customer-to-Cloud ConnectivitySecurity Boundaries and Secure ZonesSecure SDLC ImplementationDeperimeterization (SASE, SD-WAN)Network Segmentation and MicrosegmentationVPN and Always-On VPN SolutionsAuthentication and Authorization System DesignCloud Data Security and Encryption KeysShadow IT Detection and GovernanceContainer Security and OrchestrationServerless Workload SecurityContinuous Authorization and Monitoring
Test mode:
Start practice test

SecurityX - Security Architecture Example Questions

Test your knowledge of Security Architecture

Question 1

A company is migrating from a traditional network to an SDN-based architecture. The security team is concerned about the new attack surface this introduces. They need to recommend the most critical security measure to protect the overall SDN environment. Which recommendation should the security team prioritize?

Correct Answer: Harden and protect the SDN controller with strict access controls, authentication, and redundancy since it is the centralized decision point

The SDN controller is the centralized brain of the entire software-defined network, making it the single most critical component to secure because compromising it gives an attacker control over all network forwarding decisions, traffic flows, and policies across the entire infrastructure.

Encrypting all data plane traffic with IPsec adds significant overhead and addresses confidentiality rather than the core architectural risk. Deploying IDS on every switch is operationally impractical and focuses on detection rather than preventing compromise of the central control point. Securing individual switch management interfaces misunderstands SDN architecture, where switches are dumb forwarding devices controlled centrally rather than making independent forwarding decisions.

Key concept tested: understanding SDN architecture and the critical importance of securing the centralized controller as the primary attack surface.

Question 2

A small company just set up its first network and wants to keep track of all devices connected to it. The IT administrator asks what the first step should be in building an asset management program. What is the most appropriate initial action?

Correct Answer: Create a comprehensive inventory of all hardware and software assets currently in use

The foundation of any asset management program is first knowing what you have, so creating a comprehensive inventory of all hardware and software assets is the essential first step before any other actions can be taken.

Establishing an attestation schedule is a later governance activity that requires an existing inventory to verify against. Deploying a CMDB with relationship mappings is a more advanced maturity step that presupposes you already have a baseline inventory. Implementing vulnerability scanning categorizes assets by risk but cannot serve as the primary inventory mechanism and depends on knowing what assets exist first.

The key concept tested is the foundational role of asset inventory in building an asset management program.

Question 3

A team member asks how to quickly check if employees are using unapproved cloud apps. The analyst has access to the company's DNS server logs. What should the analyst do with these logs to identify potential Shadow IT?

Correct Answer: Review the DNS query records to find unfamiliar SaaS domain names being resolved by employee devices

Reviewing DNS query records for unfamiliar SaaS domain names is the most direct way to identify Shadow IT because DNS logs reveal every cloud service employees are accessing, including unapproved ones, by showing domain resolution requests from their devices.

Cross-referencing with firewall allow lists focuses on validating already-approved traffic rather than discovering unknown services. DNS logs do not contain bandwidth or data consumption metrics, so measuring bandwidth per application is not possible from DNS data alone. Filtering for failed resolution attempts would only catch services that were already blocked, missing the unapproved services that are actively being used.

Key concept tested: using DNS log analysis to detect unauthorized cloud service usage (Shadow IT discovery).

More Security Architecture questions
1031 questions (total)
Practice 100 questions
One session at a time, always new questions