Security Architecture: what Security+ tests and how to prepare
Where controls go and why. This domain moves from knowing that a control exists to placing it correctly in an architecture — on premises, in the cloud, or across both — and it leans heavily on networking knowledge the exam does not teach.
What this domain covers
The list below follows the published exam objectives for SY0-701. Depth matters more than breadth here: the exam asks you to apply these ideas to a scenario, not to recite them.
- Architecture models and their security implications: cloud, infrastructure as code, serverless, microservices, on-premises, centralised versus decentralised, virtualisation, IoT, ICS/SCADA and embedded systems.
- Secure infrastructure design: device placement, security zones, attack surface, connectivity, failure modes, and whether a device is fail-open or fail-closed.
- Data protection concepts — classification, data states, sovereignty, and methods including encryption, hashing, masking, tokenisation, obfuscation and segmentation.
- Resilience and recovery: high availability, site considerations, testing, backups, power and continuity planning.
Where candidates lose marks
- Choosing a control that is correct in isolation but wrong for the stated placement. The question usually turns on where the device sits, not what it does.
- Confusing tokenisation with masking, or hashing with encryption. Each has a different reversibility property, and that property is the answer.
- Missing fail-open versus fail-closed. Availability and security pull in opposite directions here, and the scenario tells you which one the business prioritises.
For every architecture question, identify the asset being protected before evaluating options. The asset determines the control; working the other way round produces answers that are defensible in general and wrong for the scenario.
Find out if this domain is your weak one
20 free Security+ questions, no card required. Readiness is reported per domain, so you can see whether Security Architecture is where your revision should go.