CompTIA Security+ SY0-701 · Free study guide

Objective 3.2 — Apply secure design principles to enterprise infrastructure

Secure infrastructure limits trust, places controls at meaningful boundaries, and preserves required traffic. Begin with data flows: who initiates each connection, which service receives it, what identity is used, what protocol protects it, and which control can observe or enforce the policy.

A screened subnet exposes selected public services without granting direct access to internal resources. Internal segmentation separates user, server, management, development, backup, and sensitive-data zones. Microsegmentation can enforce workload-level policy, but only if identity, inventory, and rule ownership are dependable.

Place the right control

Packet-filtering and stateful firewalls make network and transport decisions. Next-generation or application-aware controls can inspect higher-layer context. Layer 4 policy is useful for address, protocol, and port decisions; Layer 7 inspection understands application behavior but consumes more resources and may need decryption design. IDS observes and alerts; IPS can block inline but must be tuned to avoid unsafe disruption.

Device attributes affect both enforcement and failure behavior. An active control changes traffic or system state; a passive control observes and reports. An inline appliance sits in the traffic path and can enforce immediately, but failure or overload can interrupt the flow. A passive sensor connected through a network tap or monitor port receives a copy outside the forwarding path, so it cannot directly block the original traffic and may miss evidence if mirroring drops packets. Place jump servers, proxies, IDS/IPS, load balancers, and sensors according to the flow they must observe or control, then document whether each design fails open, fails closed, or loses visibility.

Load balancers distribute traffic and may terminate TLS. Proxies mediate requests. Jump hosts constrain administrative entry. Network access control evaluates devices before or during connection. Choose placement so management interfaces are not exposed through the same path as user traffic.

Protect communication and remote access

TLS protects application communications when certificate identity and protocol configuration are validated. IPsec protects network-layer traffic and is common for site-to-site tunnels. A VPN is a protected connectivity pattern, not automatic authorization to every internal system. Remote access should combine strong authentication, managed-device posture, scoped resources, logging, and session controls.

SD-WAN centralizes path and policy management across wide-area links. Secure access service edge combines networking and security services through distributed cloud delivery. These designs can improve consistent enforcement, but configuration, identity, availability, provider dependency, and log integration remain customer concerns.

Review attack surface and failure modes. A single inspection appliance may become a bottleneck or single point of failure. A broad “allow any” rule can defeat careful segmentation. A security device’s management plane needs separate protection, backup, and monitored administration.

Decision rule: derive allowed flows from business need, deny unneeded paths, authenticate both users and systems, use secure protocols, and validate that controls fail in an acceptable way.