Chapter 3: Security Architecture

Domain 3 of the Security+ SY0-701 exam accounts for 18% of the questions, which makes it the third-largest domain on the test. It is also the most "design-oriented" domain: instead of asking only what a technology is, CompTIA wants to know whether you can choose the right architecture for a given situation — where to segment, which protocol to secure, which backup strategy restores fastest, and which door, fence, or sensor protects which asset. This chapter builds that design judgment topic by topic.

What you will learn

By the end of this chapter you will be able to:

• Explain how VLANs, microsegmentation, air gaps, jump servers, proxies, load balancers, and sensors are combined to build a segmented, defensible network.
• Describe port security with 802.1X and compare the common EAP methods used to authenticate devices and users.
• Apply the cloud shared responsibility model and explain the security implications of infrastructure as code, serverless computing, containers, and microservices.
• Explain the roles of a cloud access security broker (CASB), SASE, and SSE in securing cloud access.
• Compare Type 1 and Type 2 hypervisors and mitigate virtualization risks such as VM escape and VM sprawl.
• Select the correct secure protocol for a scenario, including TLS, IPSec, SFTP, FTPS, DNSSEC, SRTP, LDAPS, and SNMPv3.
• Distinguish directory services, federation, SAML, OAuth, and OpenID Connect, and state which problems each one solves.
• Describe why embedded systems and IoT devices are hard to secure and which compensating controls apply.
• Design for high availability and resilience using load balancing, clustering, backups, snapshots, RAID, power protection, geographic dispersion, and alternate sites.
• Classify data, identify its state (at rest, in transit, in use), choose an encryption level, and select an approved disposal method.
• Apply physical security controls such as bollards, fencing, sensors, cameras, Faraday cages, and secure areas.

Reading

Network architecture: segmentation is the foundation

Most real-world breaches follow the same pattern: an attacker gains a foothold on one unimportant machine, then moves sideways — laterally — until they reach something valuable. Segmentation exists to break that path. By dividing a network into zones with controlled crossings, you ensure that compromising a printer does not hand the attacker a route to the database server.

VLANs. A virtual LAN (VLAN) groups switch ports into separate broadcast domains regardless of physical location. A common design places workstations, servers, VoIP phones, printers, and guest devices on different VLANs, with a firewall or ACLs controlling which VLANs may talk to each other. VLANs are a logical control, not a physical one, so they must be configured carefully: the best-known attack against them is VLAN hopping, performed either by switch spoofing (negotiating a trunk with the switch using DTP) or by double tagging frames so they jump from the native VLAN into another. Mitigations include disabling dynamic trunking on access ports, setting the native VLAN to an unused ID, and pruning unused VLANs from trunks.

Microsegmentation takes the same idea much further. Instead of a handful of large zones, workloads are divided into very small segments — sometimes down to a single application tier or even a single workload — with firewall policy enforced between each pair, typically by software (host firewalls, hypervisor rules, or a software-defined networking platform). A web server may be permitted to talk to its application server on one port only, and the application server to the database on one port only. If the web server is compromised, the attacker still has no path anywhere else. Microsegmentation is a core building block of zero trust designs.

Air gaps. The strongest segmentation is physical: an air-gapped system has no network connection to other systems at all. Air gaps protect industrial control networks, classified systems, and offline backup copies. The trade-off is usability — data crosses only by removable media, which becomes the new attack vector (the Stuxnet worm reached air-gapped centrifuges exactly this way), so media must be scanned and controlled.

Jump servers (also called jump boxes or bastion hosts) are hardened, monitored systems that administrators must connect to first before managing servers in a protected zone. Instead of allowing SSH or RDP from every workstation to every server, you allow it only from the jump server. This creates a single choke point you can patch aggressively, protect with MFA, and record session-by-session. A jump server that allows general internet browsing or email defeats its own purpose — it should do administration and nothing else.

Proxies. A forward proxy sits between internal users and the internet, making requests on their behalf. It enables URL filtering, malware scanning of downloads, caching, and a single point of logging for web activity; it also hides internal IP addresses from external sites. A reverse proxy faces the other way: external clients connect to the proxy, which forwards requests to your web servers. Reverse proxies provide load balancing, TLS termination, and a layer where a web application firewall (WAF) can inspect traffic before it reaches the application. A transparent proxy intercepts traffic without client configuration, while an explicit proxy is configured on the client or pushed by policy.

Load balancers distribute sessions across multiple servers so no single server is overwhelmed and one server can fail without an outage. A Layer 4 balancer routes by IP address and port; a Layer 7 balancer understands the application protocol and can route by URL, cookie, or header. Scheduling algorithms include round robin, least connections, and weighted methods, and affinity (session persistence) keeps a given user attached to the same server when the application requires it. Health checks let the balancer stop sending traffic to a failed server automatically. Load balancers are both an availability and a security control: they can absorb some denial-of-service traffic and present a single, hardened TLS endpoint to the internet.

Sensors and unified platforms. You cannot defend what you cannot see. Network sensors — IDS and IPS devices, packet brokers, and flow collectors — watch traffic at strategic points. A unified threat management (UTM) appliance bundles several functions (firewall, IDS/IPS, antivirus, content filtering, VPN) into one device; this is convenient for small networks but can become a bottleneck and a single point of failure, which is why larger environments prefer dedicated next-generation firewalls and separate sensors. Placement matters: a sensor placed only at the perimeter sees nothing of the lateral movement happening inside.

VPN architecture. Virtual private networks extend your architecture securely across untrusted networks, and the exam tests two design choices. Remote access VPNs connect individual users to the organization; site-to-site VPNs connect whole networks through gateways and typically use IPSec tunnel mode. For remote access, a full tunnel routes all of the user's traffic — work and personal — through the organization, maximizing visibility and control. A split tunnel sends only organization-bound traffic through the VPN while the user's other traffic goes directly to the internet, saving bandwidth but creating a path by which the endpoint straddles a trusted network and the open internet simultaneously; an attacker who compromises a split-tunnel endpoint may reach into the organization through it. Neither choice is universally correct, but if a scenario emphasizes the risk of an unmanaged home network reaching internal systems through a remote user's laptop, split tunneling is the weakness being described. Modern designs increasingly replace broad VPN access with ZTNA, which grants access per application rather than placing the user on the network at all.

Port security: 802.1X and EAP

Port security controls who may connect to your wired and wireless networks in the first place. The most important mechanism is IEEE 802.1X, a port-based network access control standard. Three roles participate:

• The supplicant is the device requesting access (a laptop, phone, or its operating-system agent).
• The authenticator is the switch or wireless access point. It keeps the port in an unauthorized state — passing only authentication traffic — until the supplicant proves itself.
• The authentication server, usually RADIUS, makes the decision and tells the authenticator to open the port, often placing the device on a specific VLAN based on policy (for example, corporate laptops on the staff VLAN, unknown devices on a restricted guest VLAN, failed devices on a quarantine VLAN).

Authentication itself uses the Extensible Authentication Protocol (EAP), a framework that supports many methods. The methods CompTIA expects you to compare are:

802.1X is also the foundation of network access control (NAC). A NAC solution can check device posture — patch level, disk encryption, endpoint agent present — before granting full access, and quarantine devices that fail. Combined with RADIUS accounting, 802.1X answers three questions for every connection: who is this, should they be allowed, and what did they do while connected?

Cloud security

Shared responsibility. Every cloud service divides security duties between the provider and the customer, and the dividing line moves with the service model. The provider always secures the physical facilities and the underlying hardware. With IaaS, the customer still manages the guest operating system, patching, applications, and data. With PaaS, the provider also manages the OS and runtime, and the customer manages applications and data. With SaaS, the provider manages nearly the whole stack, yet the customer always remains responsible for their data, their user accounts, and access configuration. The most common cloud breaches are not provider failures — they are customer misconfigurations, such as publicly exposed storage buckets, which sit squarely on the customer's side of the line.

Infrastructure as code (IaC) defines environments — networks, servers, permissions — in machine-readable templates that are deployed automatically. Security benefits are consistency (no hand-built snowflake servers), reviewability (changes go through version control and peer review), and rapid rebuilding. The corresponding risks are equally structured: one error in a template is replicated to every deployment, templates may contain hard-coded secrets, and environments can drift when someone changes a setting manually outside the template. IaC scanning tools check templates for misconfigurations before deployment.

Serverless computing (functions as a service, such as AWS Lambda or Azure Functions) removes servers from the customer's view entirely: the provider runs short-lived functions in response to events. The provider patches the OS, but the customer is responsible for the function code, its permissions, and its data. The classic serverless failure is an over-privileged function — if a function that resizes images holds permissions to delete a database, a code flaw becomes a catastrophe. Give each function the least privilege it needs, validate all event input, and watch out for vulnerable third-party libraries bundled into functions.

Containers and microservices. Containers package an application with its libraries but share the host kernel, so a kernel vulnerability or a misconfigured privileged container can endanger every container on the host. Microservices split an application into many small, independently deployed services that talk over APIs. This improves resilience and scaling but multiplies the attack surface: every service-to-service call needs authentication and encryption, APIs need gateways and rate limiting, and secrets must be distributed securely to dozens of services. Container-specific risks to remember are poisoned or outdated images from public registries, exposed orchestrator dashboards (for example, an unauthenticated Kubernetes API), and containers running as root.

CASB, SASE, and SSE. A cloud access security broker (CASB) sits between users and cloud services — deployed as a proxy, through APIs, or both — to give the organization visibility and control over cloud usage. CASBs discover shadow IT, enforce data loss prevention (DLP) rules on uploads, and can block unsanctioned services. Secure access service edge (SASE) is an architecture that converges networking (SD-WAN) with cloud-delivered security. Its security half, security service edge (SSE), bundles three core services: zero trust network access (ZTNA), which grants per-application access instead of full network access; a secure web gateway (SWG) for web filtering; and CASB functionality. If a question describes remote users connecting through a cloud security stack that checks identity and device before granting access to individual applications, it is describing SASE/SSE with ZTNA.

Virtualization security

A hypervisor lets many virtual machines (VMs) share one physical host. Type 1 (bare-metal) hypervisors run directly on the hardware — examples include VMware ESXi and Microsoft Hyper-V — and are the standard for data centers because of performance and a smaller attack surface. Type 2 (hosted) hypervisors run as an application on top of a conventional operating system — examples include VirtualBox and VMware Workstation — and are common on developer desktops; they inherit every vulnerability of the host OS beneath them.

Two virtualization-specific risks appear constantly on the exam. VM escape occurs when an attacker inside a guest VM breaks out and executes code on the hypervisor or host — the worst-case virtualization failure, because every guest on that host is now exposed. Mitigations include rigorous hypervisor patching, minimizing host services, and avoiding unnecessary guest-to-host features such as shared folders and clipboard integration. VM sprawl is the uncontrolled growth of VMs: administrators create test machines, forget them, and the unpatched, unmonitored orphans become easy entry points. The fix is process, not technology — an inventory, an approval workflow, expiration dates on temporary VMs, and periodic audits comparing running VMs against the authorized list.

Remember also that a snapshot is a point-in-time image of a VM's state, invaluable for rolling back a bad patch in minutes. Snapshots are not backups: they live on the same storage as the VM, degrade performance if kept too long, and disappear with the host. Treat them as a short-term operational tool.

Secure protocols and their uses

A recurring SY0-701 task is matching a service to its secure protocol. The pattern is simple: nearly every legacy protocol transmitted credentials and data in clear text, and each has a hardened successor. Know what each protocol protects, and what it does not protect.

TLS (Transport Layer Security) encrypts and authenticates connections between two endpoints. It is the successor to SSL and powers HTTPS (TCP 443), but it also secures email submission, VPNs, and countless APIs. TLS provides confidentiality and integrity in transit and authenticates the server (and optionally the client) with certificates.

IPSec secures traffic at the network layer and is the classic VPN protocol suite. It has two core protocols: AH (Authentication Header), which provides integrity and origin authentication but no encryption, and ESP (Encapsulating Security Payload), which provides encryption plus integrity and is used in almost all real deployments. IPSec operates in transport mode, which protects the payload between two hosts end-to-end and is used for host-to-host traffic, or tunnel mode, which encrypts the entire original packet inside a new one and is used between gateways for site-to-site VPNs. Key exchange is handled by IKE. When a question contrasts a VPN that connects two offices (tunnel mode, gateway to gateway) with one that protects traffic between two specific hosts (transport mode), it is testing IPSec.

SFTP and FTPS both secure file transfer, but they are different protocols and a favorite exam trap. SFTP is an entirely separate protocol built on SSH (TCP 22) — despite the name, it is not "FTP with security added." FTPS is the original FTP protocol protected with TLS; it uses TCP 990 for implicit TLS (and 989 for data) or begins on TCP 21 and upgrades with explicit TLS. If a scenario requires file transfer through a firewall with a single port, SFTP's single connection is far easier to accommodate than FTPS's multiple channels.

DNSSEC protects the integrity of DNS. It adds digital signatures (RRSIG records) to DNS data so resolvers can verify that answers genuinely came from the zone owner and were not tampered with — defeating DNS cache poisoning. DNSSEC does not encrypt queries; anyone can still observe them. (Encrypting DNS lookups is the job of DNS over TLS or DNS over HTTPS, a different technology.) Exam questions regularly offer "encrypts DNS traffic" as a wrong description of DNSSEC.

SRTP (Secure Real-time Transport Protocol) encrypts voice and video media streams — the audio in a VoIP call — providing confidentiality and integrity for media that plain RTP sends in the clear. Signaling protocols set the call up; SRTP protects what is said during it.

LDAPS is LDAP directory traffic wrapped in TLS, using TCP 636, protecting directory queries and — critically — the credentials used in LDAP binds. Plain LDAP on TCP 389 sends simple-bind passwords in clear text. (LDAP can also be upgraded with StartTLS on 389; the dedicated secure port is 636.)

SNMPv3 is the only secure version of the Simple Network Management Protocol used to monitor and manage network devices. Versions 1 and 2c authenticate with community strings sent in clear text and offer no encryption. SNMPv3 adds user-based authentication and optional encryption of the management traffic itself. A question that shows SNMPv2c in a security audit expects you to flag it and recommend SNMPv3.

Identity architecture: directories, federation, SAML, OAuth, and OIDC

Modern identity architecture answers two different questions: who are you (authentication) and what may you do (authorization). Several technologies in this section are constantly confused because they overlap, so anchor each to the problem it solves.

Directory services are the central database of identities — users, groups, computers, and their attributes — queried using LDAP. Microsoft Active Directory is the best-known example. Applications and systems consult the directory to authenticate users and look up group memberships that drive access decisions. Directory data is high-value: an attacker who controls the directory controls the identities inside it, which is why directory traffic is encrypted (LDAPS) and domain controllers are hardened and monitored.

Federation lets two organizations — or an organization and a cloud provider — trust each other's authentication. A user signs in once at their home identity provider (IdP), and that login is accepted by the partner's service provider (SP) without a second password. Federation is what makes single sign-on (SSO) across company and cloud boundaries work, and it means passwords stay with the IdP instead of being copied to every application.

Two protocol families implement federation, and keeping them straight is a classic exam objective:

• SAML (Security Assertion Markup Language) is an XML-based standard for enterprise SSO. The IdP issues a signed XML assertion stating who the user is, and the SP trusts it. SAML is dominant in enterprise web SSO with browsers.
• OAuth 2.0 is an authorization framework, not an authentication protocol. It lets a user grant a third-party application limited access to their resources — for example, letting a photo-printing site access photos stored elsewhere — using access tokens, without sharing a password. OAuth answers "this app may act on my behalf, within this scope."
• OpenID Connect (OIDC) adds the missing authentication layer on top of OAuth 2.0. It introduces an ID token (a JSON Web Token) that proves who the user is. OIDC is the modern choice for consumer and mobile SSO — the "Sign in with…" buttons you see everywhere.

The one-line summary to memorize: SAML authenticates for enterprise web SSO with XML assertions; OAuth grants delegated authorization with tokens; OIDC adds authentication (ID tokens) on top of OAuth.

Embedded systems and IoT constraints

Embedded systems — the controllers inside printers, cameras, HVAC units, medical devices, vehicles, appliances, and industrial equipment — run the physical world, and they are the hardest devices on the network to secure. Their limitations are architectural, not accidental:

• Constrained resources. Tiny processors and memory mean no room for endpoint agents, and real-time operating systems (RTOSs) prioritize timing guarantees over security features.
• Patching is rare or impossible. Firmware may be updatable only by physical access, only during downtime windows, or never — vendors abandon products while devices run for decades. Many devices cannot be taken offline because a process depends on them.
• Weak defaults. Default or hard-coded credentials, unnecessary services left enabled, and unencrypted management interfaces are common.
• Long life and invisibility. Devices are installed and forgotten, never entering the asset inventory, so nobody notices when they are compromised.

Because you cannot fix the device itself, the defense is compensating controls around it: isolate embedded and IoT devices on their own network segments with tightly restricted rules (a camera needs to talk to its recorder, nothing else); change or disable default credentials where possible; disable unused ports and services; put management interfaces behind jump servers or a management VLAN; and monitor their traffic for anomalies, since a thermostat suddenly scanning the network is an unmistakable alarm. For procurement, require vendor support commitments and update mechanisms before purchase — it is the only moment you have leverage.

High availability and resilience

Availability is a security property, and architecture is where it is won or lost. The goal is systems that keep working through failures, attacks, and disasters — and recover predictably when they cannot.

Load balancing and clustering. As covered earlier, load balancers spread traffic so individual servers can fail or be patched without downtime. Clustering goes further: multiple nodes operate as one logical system. In an active/active cluster all nodes serve traffic simultaneously; in an active/passive cluster standby nodes wait idle until a failure triggers failover. Clustering protects against node failure; geographic distribution protects against site failure.

Backups. Backups are the last line of defense, and the exam tests three types precisely:

A common rotation is a weekly full backup with daily incrementals or differentials. Whichever scheme you choose: keep copies offline or immutable (ransomware deliberately destroys online backups), keep a copy off-site (the 3-2-1 rule: three copies, two media types, one off-site), encrypt backup media, and test restores — an untested backup is a hope, not a control. Snapshots complement backups for short-term rollback but, as noted, are not substitutes.

RAID protects availability at the disk level by combining drives. RAID 0 (striping) improves performance but offers no redundancy — one failed disk loses everything. RAID 1 (mirroring) duplicates data on two disks. RAID 5 (striping with distributed parity) tolerates one disk failure using the capacity of one disk for parity. RAID 6 uses double parity and tolerates two failures. RAID 10 combines mirroring and striping for performance plus redundancy. Repeat the mantra: RAID is not a backup — it does not protect against deletion, corruption, ransomware, or fire, because all copies are online and change together.

Power protection. A UPS (uninterruptible power supply) is a battery that provides minutes of power — enough to bridge short outages or shut systems down cleanly. A generator provides hours to days of power but takes time to start and needs fuel. Facilities pair them: the UPS bridges the gap until the generator takes over.

Geographic dispersion and alternate sites. Spreading systems across distant locations protects against regional disasters. When an organization maintains a recovery site, the exam distinguishes three types by readiness:

Tabletop exercises prepare the people. Participants walk through a disaster or incident scenario verbally — "the primary data center just flooded; what do we do first?" — discussing roles and decisions without touching production systems. Tabletops are cheap, expose gaps in plans and contact lists, and are the exercise type CompTIA contrasts with full failover tests, which actually move operations and carry real risk.

Data: classification, states, encryption, and disposal

Classification assigns data a sensitivity level so handling rules can follow it. A typical scheme runs from public (no harm if disclosed), through internal/private (employees' personal information, internal documents), confidential (trade secrets, customer data under contract), to restricted/critical (the most sensitive data, such as authentication secrets and regulated records, with the strictest access). Labels drive controls: encryption requirements, who may access, whether data may leave the building, and how it must be destroyed. Regulated categories — health records, payment card data, personal data under privacy law — often carry legally mandated classifications of their own.

Data states. Data exists in one of three states, each needing different protection:

• At rest — stored on disks, tapes, databases. Protected by storage encryption and access controls.
• In transit — moving across a network. Protected by TLS, IPSec, and the other secure protocols in this chapter.
• In use — actively being processed in memory or displayed. The hardest state to protect; encryption must be temporarily removed for processing, so controls here are access control, memory protection, and endpoint security.

Encryption levels describe where encryption is applied to stored data, from broadest to most granular:

Finer granularity means more targeted protection and more key-management complexity. Full-disk encryption protects a powered-off stolen laptop perfectly — and does nothing against an attacker who compromises the running system, because the data is transparently decrypted for legitimate processes.

Disposal. Data must be destroyed so it cannot be recovered, and the method depends on the media and the data's classification. Wiping overwrites media with patterns or zeros so it can be reused — appropriate for lower classifications and magnetic drives, but unreliable on SSDs, whose wear-leveling hides data from overwrite commands (SSDs need manufacturer secure-erase or cryptographic erase). Destruction renders media unusable: shredding, disintegration, incineration, or pulverizing; degaussing — exposure to a powerful magnetic field — destroys magnetic media but not SSDs. After destruction, organizations obtain a certificate of destruction documenting what was destroyed, when, by whom, and by what method; this certificate is the audit evidence that disposal actually happened.

Physical security

Technical controls mean little if an attacker can simply walk up to the hardware. Physical security layers barriers, detection, and deterrence around facilities.

Perimeter controls. Bollards are short, sturdy posts that stop vehicles from ramming entrances or driving into pedestrian areas and equipment — they are the anti-vehicle control the exam expects whenever a scenario mentions protecting a building or outdoor asset from a vehicle. Fencing defines the boundary, delays intruders, and supports signage that establishes legal notice; gates control passage through it. Lighting removes hiding places and makes cameras effective.

Sensors and cameras. Sensors detect intrusion and environmental threats: infrared and motion sensors, pressure mats, ultrasonic and microwave detectors, door and window contacts, and glass-break sensors. Cameras (CCTV) deter, detect, and — critically — provide recorded evidence after an incident; pan-tilt-zoom (PTZ) cameras can be aimed at activity, while fixed cameras watch defined chokepoints. Sensors and cameras must themselves be monitored — an unreviewed camera archive is evidence, not prevention.

Specialized protections. A Faraday cage is a conductive enclosure that blocks electromagnetic signals in both directions. It protects sensitive equipment from external interference and eavesdropping on electromagnetic emanations, and it prevents wireless devices inside from communicating out — useful for forensic examination of phones and for labs testing wireless equipment. Secure areas are rooms with elevated controls — reinforced construction, strict badge access, no windows, and sometimes air-gap isolation — used for server rooms, evidence storage, and cryptographic key ceremonies. Access control vestibules (mantraps), which allow only one person through one door at a time, prevent tailgating into these spaces.

Key terms

Exercises

Exercise 1: Design a segmented network on paper

Scenario: BrightSmile Dental has 3 operatories, a front desk with 4 PCs, an office manager's PC, a server holding patient records, card payment terminals, IP phones, a waiting-room guest Wi-Fi, and networked X-ray equipment running old, unpatchable software. Internet speed is modest and there is one part-time IT contractor.

1. Draw five boxes representing VLANs and assign every device above to exactly one VLAN. (Hint: patient records and payment terminals should never share a VLAN with guest devices or the X-ray equipment.)
2. For each pair of VLANs, draw an arrow only where communication is genuinely required (for example, front desk → server for the records application). Everything with no arrow is denied by default.
3. Add a jump server. Draw which VLAN it lives in and mark the single path the IT contractor uses: contractor → VPN → jump server → server VLAN.
4. Place the X-ray equipment on its own VLAN with rules allowing traffic only to the records server application port. Write one sentence explaining why this is a compensating control.
5. Add a sensor position that would let you see traffic crossing between VLANs, and label the guest Wi-Fi path so it reaches only the internet.
6. Review your drawing: pick any two devices and trace the path an attacker who compromised one would need to reach the other. If the path crosses no firewall rule, you have found a design error — fix it and note what you changed.

Exercise 2: Secure protocol audit

Scenario: A scanner reports the following services on a small business network: Telnet (23) on a switch, FTP (21) used nightly by a partner, HTTP (80) for the company website, SNMPv2c on all network devices, LDAP simple binds (389) between an application and the directory, and clear-text RTP for the phone system.

1. Create a table with four columns: Finding, Risk in one sentence, Secure replacement, New port(s).
2. Fill in the row for Telnet first (replacement: SSH, 22). Complete the remaining five rows from this chapter.
3. For the FTP row, write two versions: one choosing SFTP and one choosing FTPS. Add a note on which you would pick if the partner's firewall team complains about opening many ports, and why.
4. For the SNMP row, state the exact feature SNMPv3 adds that v2c lacks (two features).
5. For the DNS row — add one yourself: the company's DNS zones have no DNSSEC. Write the finding and the one-sentence correction, being careful to state what DNSSEC does not do.

Exercise 3: Backup rotation and recovery site decision

Scenario: A 40-person accounting firm keeps its data on one file server. Requirements: at most 4 hours of data may be lost (RPO), systems must be back within 1 business day of a server failure (RTO), and within 3 days of losing the whole office. Budget is limited.

1. Design a weekly rotation using a Sunday full backup and daily backups Monday–Friday. Choose incremental or differential for the daily backups and justify the choice in two sentences based on restore effort.
2. It is Friday morning and Thursday night's backup completed. The server dies. List, in order, exactly which backup sets you must mount to restore, for your chosen scheme.
3. Repeat step 2 for the other scheme. Which restore is simpler, and which nightly backup ran faster during the week?
4. Classify the firm's recovery arrangement if it rents empty office space with power and internet but no equipment, and write which site type that is. Then state what would have to change for it to become a warm site.
5. Add the two protections this chapter requires for the backups themselves: one against ransomware, one that proves your restores work.

Exercise 4: Physical security walkthrough

Scenario: A software company occupies one floor. The suite door is propped open most days. The server room is a converted closet with a standard lock, no camera, and a window facing the parking lot. Delivery drivers walk through the office to a back dock. The company also examines seized phones for a forensics client in an open-plan corner.

1. List five physical findings, each in one sentence, ranked by risk.
2. For the parking-lot side, choose the control that stops a vehicle from reaching the building's glass frontage, and name it.
3. Specify camera placement (which three locations) and state the two purposes cameras serve that sensors do not.
4. Solve the forensics corner: name the enclosure that prevents a seized phone from receiving a remote-wipe command and explain in one sentence how it works.
5. Fix the tailgating problem at the suite door and server room with two controls (one procedural, one technical) and write out both.
6. Rewrite the server room's minimum standard in four bullet points using controls from this chapter (construction, access, monitoring, environment).

PBQ practice

Scenario — place the controls. Harbor Legal LLP is rebuilding its office network. The design team gives you the diagram below, described in text. Five control slots are marked. Your task is to assign the correct control to each slot and justify each placement in one sentence.

Diagram description:

• Zone A — Internet: untrusted external networks and remote staff.
• Slot 1 sits on the link between Zone A and the perimeter firewall, where all inbound web traffic to the firm's public website passes.
• Zone B — DMZ: contains the public web server and the mail relay.
• Slot 2 sits at the boundary between Zone B and Zone C, where a sensor must watch all traffic crossing into the internal network.
• Zone C — Internal LAN: staff workstations connect through access switches; Slot 3 is a capability that must be enabled on those access switches so only authenticated devices join the LAN.
• Zone D — Server segment: file servers and the client-records database. Administrators may manage these servers from Zone C only via Slot 4, a single hardened system.
• Zone E — Isolated backup segment: the backup server. Slot 5 describes how this segment must be connected to Zone D so that ransomware on the production network cannot encrypt the backups.

Controls to place (use each once): (1) Reverse proxy with WAF, (2) Network IPS sensor, (3) 802.1X port authentication, (4) Jump server, (5) Air gap (with controlled, scanned media transfer).

Your task: For each slot, write the control name and a one-sentence justification tied to the scenario. Print this page and write your answers in the spaces: Slot 1 ______, Slot 2 ______, Slot 3 ______, Slot 4 ______, Slot 5 ______.

Model answer

• Slot 1 — Reverse proxy with WAF. All inbound website traffic terminates here first, so HTTP requests are inspected and filtered before they reach the web server in the DMZ, and internal server addresses stay hidden.
• Slot 2 — Network IPS sensor. Every packet crossing from the DMZ into the internal network passes this point, so an inline sensor can both detect and block attacks arriving from the least-trusted internal zone.
• Slot 3 — 802.1X port authentication. Access switches are the authenticators in 802.1X: they keep ports closed until the connecting device or user is verified by RADIUS, keeping rogue devices off the LAN.
• Slot 4 — Jump server. Administrators authenticate to this one hardened, monitored host first; the servers in Zone D accept management connections from no other source, creating a single auditable path.
• Slot 5 — Air gap. The backup segment has no network route to or from production; backup data crosses only on controlled, scanned media, so ransomware in Zone D has no path to the backups.

End-of-chapter test

1. A company allows its web server to reach its application server on a single port, and the application server to reach its database on a single port, with these rules enforced by software on each host. Which architecture is this?
A. VLAN segmentation
B. Microsegmentation
C. Network address translation
D. Port forwarding

2. Which EAP method provides the strongest authentication because it requires certificates on both the client and the server?
A. PEAP
B. EAP-TTLS
C. EAP-FAST
D. EAP-TLS

3. A company moves its email to a SaaS product. Which responsibility remains with the company?
A. Patching the provider's mail servers
B. Physical security of the provider's data centers
C. Managing user accounts and the data placed in the service
D. Maintaining the provider's network hardware

4. Which statement about DNSSEC is correct?
A. It encrypts DNS queries so they cannot be observed
B. It digitally signs DNS records so resolvers can verify authenticity and integrity
C. It replaces DNS with a secure directory protocol on port 636
D. It encrypts voice traffic in DNS tunnels

5. An audit finds 47 running virtual machines that appear in no inventory, none of which have been patched in over a year. Which risk is this?
A. VM escape
B. Hypervisor introspection
C. VM sprawl
D. Container breakout

6. A backup scheme takes a full backup on Sunday and a differential backup each night Monday through Thursday. The server fails Friday morning. Which backups are needed for a complete restore?
A. Sunday's full and every differential from Monday through Thursday, in order
B. Sunday's full and Thursday's differential only
C. Thursday's differential only
D. Sunday's full and Monday's differential only

7. A mobile app lets users grant a third-party printing service access to their cloud photo albums without sharing their passwords. Which technology provides this delegated access?
A. SAML
B. OAuth
C. RADIUS
D. Kerberos

8. After a fire destroys its main office, a company must be fully operational within four hours at its alternate facility, where equipment is already installed and data is replicated continuously. Which site type is this?
A. Cold site
B. Warm site
C. Hot site
D. Reciprocal site

9. A loading dock's glass entrance faces a parking area where trucks turn around. Which control best protects the entrance from a vehicle impact?
A. Security fencing
B. Bollards
C. A Faraday cage
D. Motion sensors

10. A security review finds network devices managed with SNMPv2c community strings. What is the correct remediation?
A. Move management traffic to a jump server and keep SNMPv2c
B. Upgrade to SNMPv3 to gain authentication and encryption of management traffic
C. Replace SNMP with Telnet over a VPN
D. Change the community strings to longer values

Answer key

1. B — Enforcing least-privilege rules between individual workloads (web tier to app tier to database) is microsegmentation. VLANs alone divide networks into broad zones and would not typically isolate each application tier.

2. D — EAP-TLS uses certificates on both sides, avoiding reusable passwords entirely. PEAP and EAP-TTLS authenticate the server by certificate but verify the user with credentials inside the tunnel, and EAP-FAST relies on a shared Protected Access Credential.

3. C — In every service model the customer keeps responsibility for its data and for configuring who can access it. The SaaS provider manages the servers, facilities, and hardware in options A, B, and D.

4. B — DNSSEC adds digital signatures to DNS data so answers can be verified as genuine and untampered. It provides no confidentiality, so queries remain observable — encrypting DNS lookups is a different technology.

5. C — Uncontrolled, un-inventoried, unpatched VMs are the definition of VM sprawl. VM escape (A) is an attacker breaking out of a guest to the host, which the scenario does not describe.

6. B — A differential backup contains everything changed since the last full backup, so only two sets are required: the Sunday full and the most recent (Thursday) differential. Restoring every daily set in a chain describes incremental backups.

7. B — OAuth is the authorization framework designed for delegated, scoped access using tokens instead of shared passwords. SAML provides federated authentication assertions, not delegated resource authorization.

8. C — A hot site is fully equipped with continuously replicated data and can take over within minutes to hours. A warm site would still need data restored; a cold site has no equipment at all.

9. B — Bollards are the physical barriers designed to stop vehicles before they reach a building or entrance. Fencing controls pedestrian boundaries, and sensors only detect — neither stops a truck.

10. B — SNMP versions 1 and 2c send community strings in clear text and offer no encryption. SNMPv3 is the version that adds user authentication and optional encryption, which is what the finding requires.