CompTIA Security+ SY0-701 Security Architecture Practice Questions

Free Security+ Security Architecture practice test questions

8 questions from this domain with answers and explanations - different from the samples on the main CompTIA Security+ SY0-701 page. Sign up free to practice the full set.

1. Question 1Security Architecture

   What is the purpose of a data classification scheme?

   • ATo organize records alphabetically within databases
   • BTo categorize data by its sensitivity and disclosure riskCorrect
   • CTo compress stored records for greater storage efficiency
   • DTo convert data between different application file formats
   ✓ Correct answer: B

   Categorizing data by its sensitivity and disclosure risk is correct because that is the entire purpose of a classification scheme: it sorts information into tiers, such as public, internal, confidential, or restricted, based on how much harm would result if the data were exposed, altered, or lost, and those tier labels then drive exactly which handling requirements apply, including who may access the data, whether it must be encrypted at rest, how long it must be retained, and how it must be disposed of. This ensures that the strongest and most expensive safeguards are concentrated on the most sensitive information rather than applied uniformly and wastefully across everything. The closest distractor, alphabetical organization, is a database convenience with zero bearing on how sensitive the underlying information actually is. Compression addresses storage efficiency rather than risk-based handling, and format conversion changes how a file is encoded, neither of which relates to categorizing data according to the harm its disclosure could cause.

   Why the other options are wrong

   • AAlphabetical ordering is a data-organization convenience with no bearing on how sensitive information is protected.
   • CCompression addresses storage efficiency, not the sensitivity-based handling that classification defines.
   • DFormat conversion changes file encoding and has nothing to do with categorizing data by risk.
2. Question 2Security Architecture

   A security architect is designing a system that uses multiple layers of security controls, including firewalls, IDS, encryption, and access controls. Which security principle does this design implement?

   • ADefense in depthCorrect
   • BSecurity through obscurity
   • CZero trust
   • DSingle point of failure elimination
   ✓ Correct answer: A

   Defense in depth is the security design principle of layering multiple, independent controls, spanning technical measures like firewalls, IDS/IPS, and encryption, as well as administrative and physical controls, so that no single control is the only thing standing between an attacker and the protected asset. If a firewall rule is misconfigured or an IDS signature misses a new variant of malware, other layers such as endpoint protection, encryption of the data itself, or strict access controls still stand in the attacker's way, meaning one failure does not equal a full compromise. This is different from relying on a single strong control, since defense in depth assumes that every individual control can eventually fail or be bypassed and builds redundancy into the overall security posture rather than into any one component. Combining firewalls, IDS, encryption, and access controls in the same design is a textbook example of this layered approach.

   Why the other options are wrong

   • BSecurity through obscurity relies on hiding design details rather than layering real controls, and is considered a weak strategy on its own.
   • CZero trust is an access model that continuously verifies every request and never assumes trust; it is not defined simply by stacking multiple controls.
   • DEliminating single points of failure targets availability and redundancy, not the layered protective-control concept described here.
3. Question 3Security Architecture

   An organization wants to ensure high availability of their web servers. Which of the following solutions would BEST meet this requirement?

   • AImplementing a cold site for disaster recovery
   • BConfiguring a content filter on the network
   • CDeploying a load balancer with multiple server instancesCorrect
   • DEnabling full disk encryption on all servers
   ✓ Correct answer: C

   High availability for a web tier means eliminating the single point of failure that exists when only one server can handle requests, so deploying a load balancer in front of multiple redundant server instances lets client requests be spread across the pool while the load balancer continuously runs health checks against each instance. As soon as a server fails a health check, the load balancer stops routing traffic to it and shifts that traffic to the remaining healthy instances, so users experience no visible interruption even though one server is down. A cold site addresses disaster recovery for a whole site over a timeframe of hours to days, not the continuous, moment-to-moment availability of a live web tier, and neither content filtering nor full disk encryption has anything to do with keeping the service reachable when a server fails.

   Why the other options are wrong

   • AA cold site is a disaster-recovery facility that can take hours or days to bring online, so it supports recovery, not continuous availability.
   • BA content filter blocks or allows web traffic by category; it does nothing to keep servers running if one fails.
   • DFull disk encryption protects data confidentiality at rest but provides no redundancy or failover for availability.
4. Question 4Security Architecture

   Which architectural consideration ensures that if one component of a system fails, the entire system continues to function?

   • AAbstraction
   • BScalability
   • CResilience and redundancyCorrect
   • DElasticity
   ✓ Correct answer: C

   Resilience and redundancy is correct because the question asks what keeps the overall system running when a single component fails, and that is precisely what duplicate components and fault-tolerant design provide. Redundancy adds backup elements, extra servers in a cluster, dual power supplies, multiple network paths, so a failed unit has a standby ready to take over, while resilience is the broader system property of continuing to operate, perhaps in a degraded state, despite that failure. Together they eliminate single points of failure and are the foundation of high-availability design. Scalability and elasticity address handling changing load, not surviving a failure, and abstraction is a design simplification unrelated to fault tolerance.

   Why the other options are wrong

   • AAbstraction hides implementation complexity behind simpler interfaces; it is a design simplification technique and has nothing to do with surviving a component failure.
   • BScalability describes a system's ability to handle growing workload by adding resources, which is a different concern from continuing to run after a failure.
   • DElasticity automatically scales capacity up or down to match demand, but it does not by itself provide the failover or duplication needed when a component fails.
5. Question 5Security ArchitectureSelect all that apply

   A security architect is designing a resilient data center infrastructure. Which TWO of the following controls address availability? (Choose two.)

   • AMandatory access control on file systems
   • BData classification labels on all documents
   • CRedundant internet connections from different ISPsCorrect
   • DUninterruptible power supply (UPS) systemsCorrect
   • EFull-disk encryption on all servers
   ✓ Correct answer: C, D

   Redundant internet connections and UPS systems are correct because both directly target availability, the CIA-triad property this question asks about, by removing single points of failure that would otherwise take the environment offline. Redundant connections from two different ISPs mean that an outage, fiber cut, or provider failure on one link does not disconnect the organization, since traffic can fail over to the surviving provider. A UPS supplies immediate battery backup power the instant utility power drops, keeping critical systems running long enough for generators to start or for a graceful shutdown, preventing an unplanned outage. Mandatory access control, data classification, and full-disk encryption instead protect confidentiality and enforce authorization, not uptime.

   Why the other options are wrong

   • AMandatory access control on file systems enforces confidentiality by restricting who can read or write labeled data; it does nothing to keep systems available during an outage.
   • BData classification labels tag the sensitivity of documents to support confidentiality and governance policy, not to keep systems or connectivity available.
   • EFull-disk encryption on all servers protects data at rest from unauthorized access if a disk is stolen; it has no effect on system or network availability.
6. Question 6Security ArchitectureSelect all that apply

   An organization is hardening its serverless (Function-as-a-Service) deployments. Which TWO practices are MOST relevant to securing serverless functions? (Choose two.)

   • AApply least-privilege IAM roles scoped to each functionCorrect
   • BPatch the underlying host operating system manually
   • CValidate and sanitize all event inputs to prevent injectionCorrect
   • DInstall antivirus agents on the physical servers
   ✓ Correct answer: A, C

   In FaaS, the cloud provider owns and patches the underlying host OS, hypervisor, and physical servers, so customer responsibility shifts entirely to the application layer: scoping each function's IAM role to only the specific resources and actions it needs limits the blast radius if one function is compromised, and validating and sanitizing every event input, including HTTP payloads, queue messages, and storage triggers, blocks injection attacks arriving through the many possible trigger sources unique to event-driven architectures. Manually patching a host OS or installing antivirus agents on physical servers, the two wrong options, both assume customer access to infrastructure layers that simply do not exist in a serverless model; the provider abstracts them away entirely.

   Why the other options are wrong

   • BIn a serverless model the cloud provider patches the host OS; customers have no OS-level access to patch manually.
   • DCustomers cannot install agents on the provider's shared physical servers in a FaaS model; that layer is fully abstracted away.
7. Question 7Security Architecture

   To comply with PCI DSS, a retailer replaces stored card numbers with randomly generated surrogate values that have no mathematical relationship to the original, keeping the real-to-surrogate mapping in a separate secured vault. Which technique is this?

   • ATokenizationCorrect
   • BEncryption
   • CHashing
   • DCompression
   ✓ Correct answer: A

   Tokenization replaces sensitive values, like a full card number, with randomly generated surrogate tokens that have no mathematical relationship to the original data, so possessing a token alone provides no way to derive the real card number; only the secured vault holding the real-to-token mapping can reverse it. Because the tokens themselves are not sensitive, systems that only ever handle tokens fall largely out of PCI DSS scope, which is exactly why retailers adopt this approach for compliance. Encryption instead produces ciphertext that is mathematically derived from the plaintext and reversible with the correct key, meaning any system holding both ciphertext and key is technically still able to expose the real data. Hashing is one-way and never designed to be reversed for reuse, and compression merely reduces file size while remaining fully and trivially reversible, offering no confidentiality at all.

   Why the other options are wrong

   • BEncryption produces ciphertext that is mathematically derived from the plaintext and reversible with the correct key, unlike a token which has no such relationship to the original value.
   • CHashing is a one-way function not designed to be reversed back to the original value for reuse, so it cannot serve as a surrogate that a vault later maps back.
   • DCompression reduces data size and is fully, trivially reversible; it provides no confidentiality and is unrelated to protecting sensitive values.
8. Question 8Security Architecture

   An enterprise wants to place its public web and email servers where Internet users can reach them, while ensuring that a compromise of those servers does not give an attacker direct access to the internal LAN. Which network design accomplishes this?

   • AA screened subnet (DMZ) between an external and internal firewall boundaryCorrect
   • BPlacing the servers directly on the internal LAN with host firewalls
   • CPutting all servers on the same VLAN as user workstations
   • DAssigning the servers public IPs with no boundary filtering
   ✓ Correct answer: A

   A screened subnet places Internet-facing servers like web and mail hosts in their own network zone bounded by firewalls on both sides, one filtering traffic coming in from the Internet and another filtering traffic attempting to move from that zone into the internal LAN. Rules on the inner boundary are deliberately restrictive, typically permitting only the specific, minimal traffic the DMZ servers need to reach internal resources such as a database query, rather than open access to the whole network. If an attacker compromises a public-facing server, they land inside the screened subnet, not the trusted internal network, and still have to defeat the inner firewall's tight rule set to pivot further, which buys defenders detection time and limits blast radius. This layered containment is the entire purpose of the DMZ design.

   Why the other options are wrong

   • BPlacing public servers on the internal LAN, even with host firewalls, means a successful compromise lands the attacker directly among trusted internal systems.
   • CSharing a VLAN with user workstations gives a compromised server the same broadcast domain and reachability as employee machines, eliminating isolation.
   • DAssigning public IPs with no boundary filtering removes any chokepoint an attacker would need to cross, exposing the internal network directly.

How Security Architecture is tested

This domain holds 176 of the 990 questions in the Security+ bank, about 18%. The mix is 149 single-answer multiple choice and 27 multiple-response, so it is worth practising the formats as well as the content.

Once you have a few attempts recorded, CertGrid scores every domain separately and points you at the weakest one, so you can drill Security Architecture on its own rather than re-running full-length mocks.

Other Security+ exam domains

• General Security Concepts125 questions
• Threats, Vulnerabilities, and Mitigations216 questions
• Security Operations285 questions
• Security Program Management and Oversight188 questions
• All Security+ practice questions990 total
• Security Architecture study notesKey concepts
• Security practice examsAll Security

Security+ Security Architecture FAQ