CompTIA Security+ SY0-701 · Free study guide

Objective 3.1 — Compare architecture patterns and their security tradeoffs

Architecture choices redistribute responsibility; they do not make risk disappear. Start by identifying who controls identity, configuration, data, platform, physical infrastructure, and recovery. In cloud environments, the provider may secure facilities and managed platforms while the customer still owns identities, data permissions, workload configuration, and application logic. The exact boundary varies by service.

Hybrid designs place workloads across cloud and on-premises environments. They can satisfy latency, sovereignty, or legacy requirements but create additional identity, logging, routing, and policy boundaries. Third-party dependencies should be explicit, including failure and incident-notification paths.

Delivery models

Infrastructure as code makes approved configurations reviewable and repeatable. It also allows one unsafe template to scale quickly, so version control, scanning, peer review, guarded deployment, and drift detection matter. Serverless services reduce direct server administration but still require secure code, permissions, secrets, events, and data handling.

Microservices isolate business functions and can limit failure domains, yet they increase service identities, APIs, certificates, network paths, and observability needs. Containers package workloads; they do not create a security boundary equivalent to a separate physical host. Virtual machines provide stronger guest isolation in many designs but add hypervisor and image-management responsibilities.

Centralized control can create consistent policy and visibility while concentrating failure and privilege. Decentralized operation may improve local responsiveness and resilience but risks inconsistent enforcement. Software-defined networking and logical segmentation make policy programmable; physical isolation or an air gap may reduce connectivity but complicates updates, monitoring, and data transfer.

Specialized systems

IoT, embedded, real-time, industrial-control, and SCADA systems may prioritize safety, deterministic timing, or availability. They can have long lifecycles and limited patch options. Applying a workstation hardening process without understanding operational constraints can create physical harm. Use inventory, segmentation, controlled pathways, monitoring, vendor coordination, and compensating controls.

Compare models across availability, resilience, cost, responsiveness, scale, deployment, recovery, patchability, power, compute, and risk transference. Transferring contractual liability does not transfer all operational impact.

Decision rule: choose the architecture that satisfies stated constraints with explicit ownership and observable controls; avoid assuming “cloud,” “air-gapped,” or “containerized” is inherently secure.