Domain 3: Security Architecture
Where the security choices get engineered. Match architecture to constraint, place devices for visibility and control, protect data in every state, and design resilience into the system — not bolt it on after an outage.
Six Ideas That Drive Every Domain 3 Question
Architecture choices weave through 18% of the exam. Master these six and you can reason through almost any Domain 3 scenario — cloud, on-prem, hybrid, or OT.
Shared Responsibility
Provider secures of the cloud; customer secures in the cloud. The split moves with IaaS/PaaS/SaaS.
Isolate What You Can’t Patch
IoT, embedded, and ICS/SCADA rarely get patches. Segment, monitor, and compensate.
Placement Equals Power
Where a device sits determines what it can see and what it can block. Zones before devices.
State Drives Control
At rest → disk/field encryption. In transit → TLS/IPSec. In use → enclaves, tokenization.
Tokenize to Shrink Scope
Encryption protects data; tokenization shrinks the audit boundary. Different jobs.
HA ≠ DR
HA survives a server crash. DR survives losing the datacenter. Different problems, different answers.
Find Out Where to Start
4 questions across Domain 3 — see which objectives need the most work.
Focus on these objectives
You’ve got these
4 Objectives — Pick Your Path
Each lesson teaches through real scenarios — concept, textbook, hard choice, exam signal. Start anywhere or go in order. Completed lessons show a checkmark.
Cloud (IaaS/PaaS/SaaS, hybrid, shared responsibility), IaC, serverless, microservices, physical isolation, logical segmentation, SDN, on-prem, centralized vs decentralized, containerization, virtualization, IoT, ICS/SCADA, RTOS, embedded, HA — and the considerations (availability, resilience, cost, latency, patchability, power) that drive the choice.
Device placement, security zones, attack surface, connectivity, fail-open vs fail-closed, active/passive, inline vs tap, jump servers, proxies (forward/reverse), IDS/IPS, load balancers, sensors, 802.1X + EAP, firewalls (WAF, UTM, NGFW, L4, L7), VPN (site-to-site, remote access), TLS/IPSec, SD-WAN, SASE.
Data types (regulated, trade secret, IP, legal, financial), classifications (public, private, sensitive, confidential, restricted, critical), states (at rest, in transit, in use), sovereignty and geolocation, encryption, hashing, masking, tokenization, obfuscation, segmentation, permission restrictions, DLP (endpoint, network, cloud).
High availability, load balancing vs clustering, active/active vs active/passive, hot/warm/cold sites, geographic dispersion, platform diversity, multi-cloud, BCP/DRP, capacity planning, testing (tabletop, simulation, failover, parallel), backups, snapshots, replication, journaling, power (UPS, generators, dual feeds), and the metrics — RTO, RPO, MTTR, MTBF.
Architecture drills and adaptive quizzes — Coming Soon
TJS Platform will have placement puzzles, RTO/RPO matching, and AI-powered explanations for every Domain 3 objective.
Learn It, Test It, Lock It In
Each card has 3 layers. Click to advance: mnemonic → scenario challenge → answer + exam tip.
A customer uses a fully managed email service (SaaS) and gets phished. Whose responsibility was identity protection?
Customer. Identity, access, configuration, and data are the customer’s responsibility across every cloud service model — including SaaS. The provider runs the mail server; you own MFA, conditional access, and user training.
SCADA network where a false-positive block could halt physical processes. Which do you deploy inline?
IDS in monitor mode. In OT/ICS, availability and safety dominate; blocking legitimate traffic can trip a physical process. Detect + alert + engineer response; do not block inline.
A payment app processes the PAN in RAM during authorization. Which control protects it in that state?
Secure enclave / confidential computing (SGX, SEV). The data is in use. Disk encryption protects at rest, TLS protects in transit, and enclaves isolate computation for in-use.
A retailer wants analytics and BI systems removed from PCI scope. Encrypt or tokenize the PAN?
Tokenize. Downstream systems see a token with no mathematical link to the PAN — so they fall out of PCI scope. Encryption would still leave a decryptable value in those systems.
“System must be restored within 4 hours” — RTO or RPO?
RTO. Time-to-restore. RPO is about tolerable data loss — if the question said “lose no more than 15 minutes of transactions,” that’s RPO.
Internal HR system with 48-hour RTO and tight budget. Which site type?
Cold site. 48 hours is plenty of time to stand up a cold site with nightly backups. Hot or warm would be overbuilt for the stated RTO and budget.
The Forcing-Function Rule — Exam Strategy
Domain 3 scenarios encode the answer in their constraints. Ask: what are the forcing functions? RTO and RPO drive site tier and backup cadence. Data state drives the protection control. Unpatchable asset drives segmentation. Cost constraint drives you toward the simplest option that meets the requirement. Don’t overbuy.
Security+ Tests How You Design Controls
The Unpatchable MRI
PCI Scope Reduction
The Ransomware Recovery
Adaptive Domain 3 drills — Coming Soon
TJS Platform will track your weak areas and generate focused scenario drills. AI Study Buddy will explain why you got it wrong.
The Tempting Wrong Answer
Shared Responsibility Drift
SaaS is not “no security work.” Identity, access, configuration, and data remain the customer’s responsibility across every cloud service model.
Air-Gap ≠ Secure
Air-gapped systems can still be breached via removable media, vendor laptops, or supply chain. Isolation reduces exposure but does not eliminate it.
WAF vs NGFW vs UTM
WAF = HTTP-only application protection. NGFW = broad L7, app-aware, user-aware. UTM = bundled all-in-one for SMB. Different tools, different scopes.
Hashing Is Not Encryption
Hashing is one-way (no key, no reversal) and provides integrity. Passwords should be hashed with salt + bcrypt/scrypt/Argon2, never encrypted.
Sovereignty ≠ Locality
Locality is the physical location of data. Sovereignty is the legal regime that applies. An EU region does not automatically satisfy GDPR obligations.
Snapshots Are Not Backups
Snapshots live on the same storage array as the primary — same failure domain. For ransomware and site-loss, offsite/immutable backups are the real control.
RTO vs RPO Swap
RTO = time to restore (downtime tolerance). RPO = data-loss tolerance. Under pressure the two get swapped — read the units.
HA vs DR Conflation
HA addresses failures within a site (server, rack, AZ). DR addresses loss of the site. A load balancer is not a disaster recovery plan.
5 Practice Questions
Select an answer, then click Check. Full adaptive quiz engine with 200+ questions coming soon on TJS Platform.
PaaS shifts OS and runtime to the provider while the customer still owns code, data, identity, and configuration. IaaS would leave OS patching with the customer.
A jump server (bastion) concentrates and logs administrative access into a sensitive zone, enforcing MFA and auditing at a single choke point. Direct RDP bypasses the control; a WAF is for web-app traffic; site-to-site VPN is for network-to-network, not user access.
Data-in-use is the target state. Enclaves / confidential computing (SGX, SEV) protect computation from the host OS and hypervisor. Full-disk encryption protects at-rest; TLS protects in-transit; backups are a recovery control.
Data-loss tolerance is RPO (15 minutes here); downtime tolerance is RTO (1 hour here). MTTR and MTBF describe observed behavior, not stated targets.
Snapshots and onsite backups share the production failure domain. A copy in a different failure domain — offsite, immutable, or air-gapped — is what the attacker cannot reach, and is the defining control for ransomware resilience.
Continue Your Prep
Choose how you want to study. All paths lead to the same goal — passing the Security+ on exam day.
All 5 domains, 200+ adaptive questions, AI Study Buddy, timed exams, and certificate of completion.
Printable desk reference with key concepts, mnemonics, and quick-reference tables for all 5 domains.
Shared-responsibility, site tiers, data-state controls, and RTO/RPO matching on one page.