CompTIA Security+ Certification: Security Architecture

Question 1

Which network device operates by filtering traffic based on predefined rules, typically at the network and transport layers?

A. Switch

B. Firewall

C. Hub

D. Repeater

Explanation: A firewall inspects incoming and outgoing network traffic and permits or blocks it based on a defined set of security rules, commonly operating at the network and transport layers to control traffic flow between segments.

Question 2

Which of the following best describes a demilitarized zone (DMZ) in network architecture?

A. A fully isolated network segment used only for backups

B. A buffer network segment that hosts public-facing services while isolating them from the internal network

C. The core internal network where all servers reside

D. A wireless-only network segment

Explanation: A DMZ is a network segment placed between the internal trusted network and the untrusted internet, hosting public-facing services such as web or email servers while limiting direct access to the more sensitive internal network.

Question 3

Which technology allows an organization to logically segment a physical network into multiple isolated broadcast domains?

A. VLAN

B. VPN

C. NAT

D. DNS

Explanation: A virtual local area network (VLAN) logically segments a single physical network into multiple isolated broadcast domains, improving security and traffic management without requiring separate physical infrastructure for each segment.

Question 4

Which of the following best describes microsegmentation in a zero trust architecture?

A. Dividing a network into very granular, isolated segments to limit lateral movement

B. Combining all network segments into a single flat network

C. Encrypting only email traffic

D. Disabling all wireless access points

Explanation: Microsegmentation creates highly granular network zones, often down to the individual workload or application level, strictly controlling communication between segments to significantly limit an attacker's ability to move laterally after an initial compromise.

Question 5

Which cloud service model provides customers with the underlying computing infrastructure, such as virtual machines and storage, while the customer manages the operating system and applications?

A. Software as a Service (SaaS)

B. Platform as a Service (PaaS)

C. Infrastructure as a Service (IaaS)

D. Function as a Service (FaaS)

Explanation: Infrastructure as a Service provides fundamental computing resources, such as virtual machines, storage, and networking, over the cloud, leaving the customer responsible for managing the operating system, middleware, and applications running on top.

Question 6

In a public cloud shared responsibility model, who is typically responsible for securing customer data and access management?

A. The cloud service provider exclusively

B. The customer

C. A neutral third party auditor

D. No one; it is automatically secured

Explanation: Under the shared responsibility model, while the cloud provider secures the underlying infrastructure, the customer remains responsible for securing their own data, configuring access controls, and managing user identities within the cloud environment.

Question 7

Which of the following best describes a virtual private network (VPN)?

A. A technology that creates an encrypted tunnel over a public network to securely connect remote users or sites

B. A device that filters spam email

C. A method of load balancing web traffic

D. A physical network cable

Explanation: A VPN establishes an encrypted tunnel across a public network, such as the internet, allowing remote users or branch offices to securely access an organization's internal network as if directly connected to it.

Question 8

Which of the following best describes the purpose of network address translation (NAT)?

A. Encrypting data in transit

B. Translating private internal IP addresses to a public IP address for internet communication

C. Assigning hostnames to IP addresses

D. Filtering malicious email attachments

Explanation: NAT translates private, internal IP addresses used within a local network into a single public IP address (or a small pool of them) for communication with external networks, which also helps conceal the internal network's addressing scheme.

Question 9

Which of the following architectural approaches distributes application components across multiple independent, loosely coupled services?

A. Monolithic architecture

B. Microservices architecture

C. Single-tier architecture

D. Mainframe architecture

Explanation: Microservices architecture structures an application as a collection of small, independent, loosely coupled services that communicate over well-defined APIs, in contrast to a monolithic architecture where all components are tightly integrated into a single codebase.

Question 10

Which of the following is a key security benefit of containerization?

A. Containers provide complete hardware-level isolation identical to full virtual machines

B. Containers package an application with its dependencies, promoting consistency and simplifying patching across environments

C. Containers eliminate the need for any network security controls

D. Containers automatically encrypt all data at rest

Explanation: Containerization packages an application along with its dependencies into a lightweight, portable unit, ensuring consistent behavior across development, testing, and production environments and simplifying the deployment of security patches.

Question 11

Which of the following best describes the purpose of a web application firewall (WAF)?

A. Filtering traffic between internal network segments only

B. Protecting web applications by filtering and monitoring HTTP/HTTPS traffic for malicious requests

C. Managing DNS resolution for internal hosts

D. Encrypting database backups

Explanation: A web application firewall specifically inspects HTTP and HTTPS traffic to and from web applications, detecting and blocking common web-based attacks such as SQL injection and cross-site scripting before they reach the application.

Question 12

Which of the following best describes high availability in system design?

A. A system designed to remain accessible and operational with minimal downtime

B. A system that is only accessible during business hours

C. A system that requires manual intervention to restart after every failure

D. A system with a single point of failure

Explanation: High availability refers to system architectures designed with redundancy, failover mechanisms, and load balancing to minimize downtime and ensure continuous operation even in the event of individual component failures.

Question 13

Which of the following best describes load balancing?

A. Distributing incoming network or application traffic across multiple servers to optimize performance and availability

B. Encrypting data before transmission

C. Assigning static IP addresses to devices

D. Filtering malicious email content

Explanation: Load balancing distributes incoming client requests across multiple backend servers, improving performance, preventing any single server from becoming overwhelmed, and enhancing availability if one server becomes unavailable.

Question 14

Which of the following best describes an intrusion prevention system (IPS)?

A. A system that only logs suspicious activity without taking action

B. A system that actively monitors traffic and can automatically block or prevent detected threats in real time

C. A system used solely for encrypting VPN traffic

D. A system that manages user password resets

Explanation: Unlike a purely passive intrusion detection system (IDS), an intrusion prevention system is placed inline with network traffic and can actively block, drop, or reject malicious traffic in real time as it is detected.

Question 15

Which of the following best describes the purpose of a reverse proxy?

A. Allowing internal clients to access external websites anonymously

B. Sitting in front of one or more servers to intercept and forward client requests, often for load balancing and security

C. Encrypting removable media

D. Managing wireless access point channels

Explanation: A reverse proxy sits in front of backend servers, intercepting client requests before forwarding them to the appropriate server, which can improve performance, provide load balancing, and add a security layer by hiding internal server details from external clients.

Question 16

Which of the following best describes secure enclave technology?

A. An isolated, hardware-based area of a processor used to protect sensitive data and cryptographic operations

B. A cloud storage bucket with public access disabled

C. A physically locked server rack

D. A network segment reserved for guest devices

Explanation: A secure enclave is an isolated, hardware-based region within a processor that protects sensitive data, such as cryptographic keys and biometric information, from being accessed even if the main operating system is compromised.

Question 17

Which of the following protocols is the secure, encrypted replacement for Telnet used to remotely manage devices?

A. FTP

B. SSH

C. SNMP v1

D. HTTP

Explanation: SSH (Secure Shell) provides an encrypted channel for remote command-line access and management of network devices and servers, replacing the older, unencrypted Telnet protocol which transmits credentials and data in plaintext.

Question 18

Which secure protocol is used to encrypt web traffic between a client browser and a web server?

A. HTTP

B. HTTPS (using TLS)

C. FTP

D. SNMP

Explanation: HTTPS layers the Hypertext Transfer Protocol over Transport Layer Security (TLS), encrypting data exchanged between a client's browser and a web server to protect confidentiality and integrity during transmission.

Question 19

Which of the following best describes the purpose of Secure/Multipurpose Internet Mail Extensions (S/MIME)?

A. Encrypting and digitally signing email messages

B. Filtering spam messages automatically

C. Compressing large email attachments

D. Routing email between mail servers

Explanation: S/MIME is a standard used to encrypt and digitally sign email content, ensuring the confidentiality of the message and providing a way for the recipient to verify the sender's identity and confirm the message was not altered.

Question 20

Which of the following best describes an industrial control system (ICS)?

A. A system that manages and automates industrial processes, such as manufacturing or power generation

B. A consumer-grade home automation hub

C. A cloud-based email server

D. A mobile device management platform

Explanation: Industrial control systems monitor and control physical industrial processes, such as manufacturing lines, power grids, and water treatment facilities, often using specialized components like SCADA and PLCs that require distinct security considerations from typical IT systems.

Question 21

Which of the following is a common security challenge specific to Internet of Things (IoT) devices?

A. IoT devices typically have excessive processing power for encryption

B. Many IoT devices ship with weak default credentials and limited ability to receive security patches

C. IoT devices cannot connect to any network

D. IoT devices are immune to malware

Explanation: IoT devices frequently ship with weak or default credentials, limited processing power for robust security controls, and infrequent firmware updates, making them attractive and often easy targets for attackers seeking network entry points.

Question 22

Which of the following best describes an air gap in the context of ICS/SCADA security?

A. Physically isolating the control system network from corporate IT networks and the internet

B. Using a VLAN to logically separate two networks

C. Encrypting SCADA traffic with TLS

D. Installing a firewall between two subnets

Explanation: An air gap physically isolates critical ICS/SCADA networks from corporate IT networks and the public internet, eliminating any direct network pathway an attacker could use to remotely reach highly sensitive operational technology systems.

Question 23

Which of the following best describes screened subnet architecture (formerly known as a three-legged firewall DMZ)?

A. A firewall configuration with three network interfaces separating internal, external, and DMZ networks

B. A network with no firewall at all

C. A single flat network with no segmentation

D. A wireless-only network topology

Explanation: A screened subnet uses a firewall with multiple interfaces, typically one connected to the internal network, one to the external internet, and one to a DMZ, allowing granular control over traffic flowing between all three zones.

Question 24

Which of the following best describes the concept of infrastructure as code (IaC)?

A. Managing and provisioning infrastructure through machine-readable definition files rather than manual configuration

B. Writing traditional application source code only

C. Physically wiring network cables according to a blueprint

D. Manually configuring each server through a GUI

Explanation: Infrastructure as code uses machine-readable configuration files to automatically provision and manage servers, networks, and other infrastructure components, improving consistency, repeatability, and the ability to version-control infrastructure changes.

Question 25

Which of the following best describes the security benefit of using immutable infrastructure?

A. Servers can be manually patched in place indefinitely

B. Once deployed, components are never modified; updates are made by deploying entirely new instances

C. It eliminates the need for backups

D. It removes the need for any access controls

Explanation: Immutable infrastructure means deployed servers or containers are never altered after deployment; instead, any change requires building and deploying a new instance, reducing configuration drift and making it easier to detect unauthorized modifications.

Question 26

Which of the following network architecture concepts refers to designing systems so that a failure in one component does not cause a cascading failure across the system?

A. Fault tolerance

B. Load shedding

C. Port mirroring

D. Traffic shaping

Explanation: Fault tolerance is the design property that allows a system to continue operating properly even when one or more of its components fail, typically achieved through redundancy so a single failure does not cascade into a total outage.

Question 27

Which of the following best describes geographic dispersion as a resilience strategy?

A. Locating redundant systems or data centers in different physical regions to reduce the risk of a single localized disaster

B. Consolidating all servers into a single data center for easier management

C. Encrypting data based on the user's physical location

D. Assigning IP addresses based on geographic region

Explanation: Geographic dispersion places redundant infrastructure or backup copies of data in physically separated locations, ensuring that a regional disaster, such as a natural disaster or widespread power outage, does not simultaneously impact all copies of critical systems or data.

Question 28

Which of the following best describes the purpose of a jump server (jump box)?

A. A hardened intermediary system used to securely access and manage devices in a separate security zone

B. A public-facing web server hosting company marketing content

C. A backup server used only for archival storage

D. A device used to distribute IP addresses via DHCP

Explanation: A jump server is a hardened, closely monitored system that administrators must connect to first before accessing more sensitive internal systems or network zones, reducing the direct exposure of critical assets and centralizing access logging.

Question 29

Which of the following best describes full disk encryption (FDE)?

A. Encrypting only specific sensitive files on a drive

B. Encrypting the entire contents of a storage drive, including the operating system

C. Encrypting data only while it is in transit over a network

D. Encrypting data only within a database

Explanation: Full disk encryption encrypts the entirety of a storage drive's contents, including the operating system and all files, ensuring that data remains protected and unreadable if the physical device is lost, stolen, or accessed without authorization.

Question 30

Which of the following best describes the purpose of redundant array of independent disks (RAID) in a resilience strategy?

A. Encrypting data stored across multiple disks

B. Combining multiple physical disks to improve performance and/or provide fault tolerance against drive failure

C. Compressing data to reduce storage costs

D. Authenticating users before granting disk access

Explanation: RAID combines multiple physical disk drives into a single logical unit, and depending on the RAID level used, can improve read/write performance and/or provide fault tolerance by storing redundant copies or parity data to survive individual drive failures.

Question 31

Which of the following best describes the purpose of a next-generation firewall (NGFW) compared to a traditional stateful firewall?

A. An NGFW only filters traffic based on port and protocol

B. An NGFW adds deep packet inspection, application awareness, and integrated intrusion prevention capabilities

C. An NGFW eliminates the need for any access control lists

D. An NGFW only operates on wireless networks

Explanation: A next-generation firewall extends beyond traditional port and protocol filtering by adding capabilities such as deep packet inspection, application-layer awareness, integrated intrusion prevention, and user identity-based policies for more granular traffic control.

Question 32

Which of the following best describes the purpose of virtual desktop infrastructure (VDI)?

A. Hosting desktop operating system instances on a centralized server, accessed remotely by end users

B. Providing physical desktop computers to every employee

C. Encrypting files stored on a local hard drive

D. Managing DNS records for an organization

Explanation: Virtual desktop infrastructure hosts desktop operating system instances on centralized servers, which users access remotely from thin clients or other devices, allowing centralized management, patching, and data security controls over the desktop environment.

Question 33

Which of the following best describes the concept of platform diversity as a resilience strategy?

A. Using a single vendor for all critical infrastructure to simplify support

B. Using different vendors or technologies for redundant systems to avoid a common vulnerability affecting all systems simultaneously

C. Hiring employees from diverse backgrounds

D. Offering multiple pricing tiers for a cloud service

Explanation: Platform diversity involves deploying redundant systems using different vendors, operating systems, or technologies so that a single vulnerability or vendor-specific failure does not simultaneously compromise all instances of a critical service.

Question 34

Which of the following best describes the purpose of a screened host firewall architecture?

A. A single firewall combined with a bastion host to filter traffic between an external and internal network

B. A firewall that only filters outbound email traffic

C. A network with no perimeter defenses

D. A firewall used exclusively for wireless traffic

Explanation: A screened host architecture combines a router or firewall performing packet filtering with a bastion host that provides additional application-layer inspection, together controlling and screening traffic passing between an external and internal network.

Question 35

Which of the following best describes the purpose of DNS filtering as a security control?

A. Blocking access to known malicious or inappropriate domains at the DNS resolution level

B. Encrypting all outbound email traffic

C. Assigning static IP addresses to servers

D. Managing user password complexity requirements

Explanation: DNS filtering intercepts and evaluates DNS queries, blocking resolution requests for domains known to host malware, phishing content, or other malicious material, preventing users from ever establishing a connection to those harmful sites.

Question 36

Which of the following best describes an air-gapped backup strategy?

A. Storing backup copies of data on a system or medium that is physically disconnected from the network

B. Storing all backups on the same server as production data

C. Encrypting backups with the same key as production data

D. Backing up data continuously in real time only

Explanation: An air-gapped backup is stored on media or a system that is physically disconnected from the network, providing strong protection against ransomware and other network-based attacks that might otherwise reach and encrypt connected backup systems.

Question 37

Which of the following best describes the 3-2-1 backup rule?

A. Keep three copies of data, on two different media types, with one copy stored offsite

B. Back up data three times per day, every two hours, for one week

C. Use three encryption algorithms on two servers within one data center

D. Retain backups for three years, review twice annually, and delete after one final audit

Explanation: The 3-2-1 backup rule recommends maintaining three total copies of data, stored on two different types of media, with at least one copy kept offsite, reducing the risk that a single event could destroy all copies simultaneously.

Question 38

Which of the following best describes the purpose of a bastion host?

A. A hardened server specifically exposed to untrusted networks to provide a controlled access point to internal resources

B. An internal file server with no external connectivity

C. A backup server used for archival purposes only

D. A wireless access point used for guest access

Explanation: A bastion host is a heavily hardened and closely monitored server intentionally exposed to an untrusted network, such as the internet, serving as a controlled and secured gateway or access point to more sensitive internal resources.

Question 39

Which of the following best describes the purpose of an SD-WAN (software-defined wide area network)?

A. Centrally managing and optimizing WAN connections across multiple sites using software-based control

B. Encrypting individual files before email transmission

C. Replacing the need for any firewalls

D. Providing physical security for network closets

Explanation: SD-WAN uses centralized software-based control to manage and optimize traffic across an organization's wide area network connections, dynamically routing traffic across multiple links, such as MPLS and broadband, based on performance and policy requirements.

Question 40

Which of the following best describes the purpose of hashing algorithms such as SHA-256 in secure architecture design?

A. Encrypting data so it can later be decrypted with a key

B. Producing a fixed-size, one-way digest used to verify data integrity

C. Compressing large files to reduce storage requirements

D. Authenticating users through biometric scanning

Explanation: Hashing algorithms like SHA-256 generate a fixed-size, one-way digest from input data; because the process cannot be reversed to reveal the original data and any change to the input produces a different hash, they are widely used to verify data integrity.

Question 41

Which of the following best describes the purpose of segmentation between IT and operational technology (OT) networks?

A. To reduce the risk of an IT network compromise spreading to critical operational systems

B. To increase the total available bandwidth for both networks

C. To simplify network cabling requirements

D. To eliminate the need for firewalls entirely

Explanation: Segmenting IT and operational technology networks limits the pathways an attacker who compromises the traditional IT environment could use to reach and disrupt critical operational systems, such as manufacturing equipment or utility controls.

Question 42

Which of the following best describes the purpose of a virtual private cloud (VPC)?

A. A logically isolated section of a public cloud where an organization can launch resources within a defined virtual network

B. A physical data center owned exclusively by one company

C. A public Wi-Fi hotspot

D. A shared email server used by multiple tenants

Explanation: A virtual private cloud provides a logically isolated section of a public cloud provider's infrastructure, allowing an organization to define its own private IP address range, subnets, and network configurations while still using shared underlying hardware.

Question 43

Which of the following best describes the security purpose of port security on a network switch?

A. Restricting which MAC addresses are allowed to connect to a specific switch port

B. Encrypting traffic passing through the switch

C. Assigning IP addresses via DHCP

D. Filtering spam email at the network layer

Explanation: Port security restricts which specific MAC addresses are permitted to connect to a given switch port, helping to prevent unauthorized devices from being plugged into the network and mitigating certain MAC-based attacks.

Question 44

Which of the following best describes the difference between on-premises and cloud-hosted infrastructure from a security responsibility standpoint?

A. On-premises infrastructure places full security responsibility on the organization, while cloud infrastructure shares responsibility with the provider

B. Cloud infrastructure eliminates all security responsibility for the customer

C. On-premises infrastructure requires no physical security controls

D. There is no meaningful security difference between the two

Explanation: With on-premises infrastructure, the organization bears full responsibility for physical, network, and application security, whereas cloud environments operate under a shared responsibility model in which the provider secures the underlying infrastructure and the customer secures their data and configurations.

Question 45

Which of the following best describes a serverless computing (Function as a Service) model?

A. Running code in response to events without the customer needing to manage the underlying server infrastructure

B. Hosting an application on a single dedicated physical server

C. Running an application entirely offline with no cloud dependency

D. Requiring the customer to manually patch the operating system

Explanation: Serverless computing, or Function as a Service, allows developers to run individual pieces of code in response to triggering events without provisioning or managing any underlying servers, as the cloud provider automatically handles the infrastructure, scaling, and patching.

Question 46

Which of the following best describes the purpose of an intrusion detection system (IDS) operating in passive mode?

A. It monitors and alerts on suspicious traffic without directly blocking it

B. It actively drops all malicious packets in real time

C. It encrypts all network traffic automatically

D. It replaces the need for a firewall

Explanation: A passive intrusion detection system monitors network or system activity and generates alerts when suspicious behavior matching known signatures or anomalies is detected, but unlike an IPS, it does not take direct action to block the traffic itself.

Question 47

Which of the following best describes an out-of-band management network?

A. A separate, dedicated network path used to manage infrastructure devices independent of the production data path

B. A network segment used exclusively for guest Wi-Fi

C. A network that has no security controls applied

D. A backup internet connection used only during outages

Explanation: Out-of-band management uses a physically or logically separate network path dedicated to administrative access and device management, ensuring administrators can still reach and manage infrastructure even if the primary production network experiences an outage or compromise.

Question 48

Which of the following best describes the purpose of application allow listing (whitelisting)?

A. Permitting only pre-approved applications to execute on a system while blocking all others by default

B. Blocking a specific list of known malicious applications while allowing everything else

C. Automatically updating all installed software

D. Encrypting application binaries at rest

Explanation: Application allow listing takes a default-deny approach, permitting only explicitly approved applications to run on a system, which provides stronger protection against unknown or unauthorized software, including malware, compared to a default-allow blocklist approach.

Question 49

Which of the following best describes the purpose of an application programming interface (API) gateway in a secure architecture?

A. Acting as a single managed entry point that enforces authentication, rate limiting, and monitoring for backend APIs

B. Physically securing a server room housing API servers

C. Replacing the need for encryption on API traffic

D. Automatically writing application code

Explanation: An API gateway serves as a centralized, managed entry point for client requests to backend services, enforcing consistent authentication, authorization, rate limiting, and traffic monitoring policies across all exposed APIs.

Question 50

Which of the following best describes the purpose of a content delivery network (CDN) in terms of resilience and security?

A. Distributing content across geographically dispersed servers to improve availability and absorb volumetric DDoS traffic

B. Encrypting content stored in a single central database

C. Managing employee access badges

D. Filtering internal email attachments

Explanation: A content delivery network caches and distributes content across many geographically dispersed edge servers, improving performance for end users while also helping absorb and mitigate large-scale volumetric DDoS attacks before they reach the origin server.

Question 51

Which of the following best describes the purpose of secure baseline configurations applied through automation tools?

A. Ensuring systems are consistently deployed and maintained according to an approved, hardened security standard

B. Randomizing system configurations to increase unpredictability

C. Allowing every system to be configured differently based on user preference

D. Eliminating the need for any further patch management

Explanation: Automated configuration management tools enforce secure baseline configurations consistently across systems, reducing configuration drift and ensuring that all deployed assets meet the organization's approved, hardened security standard.