Security Architecture
Free CompTIA Security+ (SY0-701) practice — 6 questions on Security Architecture, with explanations. No sign-up. Full 12-question mixed test →
A hospital's perimeter firewall protects life-support monitoring systems and receives real-time vitals feeds from bedside devices. The firewall appliance suffers a hardware fault. Patient safety policy mandates that monitoring data must never be blocked, even if it means temporarily bypassing security inspection. Which failure mode should this firewall be configured to use?
Fail-open allows traffic to continue passing when the device fails, prioritizing availability — appropriate when uninterrupted data flow (e.g., life-support telemetry) is more critical than blocking potentially malicious traffic during the outage window.
A payment processor wants analytics teams to work with substitute values for stored primary account numbers (PANs). The substitute values must be reversible ONLY by the payment processor's settlement system, which maps each substitute back to the original PAN via a securely stored value vault. Which data protection technique is being described?
Tokenization replaces sensitive data with a non-sensitive token that has no mathematical relationship to the original value; only the token vault (held by the authorized system) can map the token back to the real PAN — matching the reversible, vault-based description in the scenario.
A fully remote workforce needs identity-aware access to both SaaS applications and internal apps, with security policy (SWG, CASB, ZTNA) enforced at points of presence close to each user rather than backhauling traffic through a central data center. Which architecture BEST meets this requirement?
SASE (Secure Access Service Edge) combines SD-WAN networking with a cloud-delivered security stack (SWG, CASB, ZTNA, FWaaS) enforced at distributed edge nodes near the user, providing identity-aware policy without backhauling traffic.
During a cloud security audit, an engineer finds that running EC2/VM configurations no longer match the versioned Terraform templates stored in the repository — extra open ports and manually added rules exist that were never committed to source control. What is this phenomenon called, and what should be done first?
Configuration drift occurs when live infrastructure deviates from its Infrastructure-as-Code (IaC) definition, typically from manual out-of-band changes. The correct first step is comparing actual state against the IaC template (e.g., 'terraform plan') to identify and reconcile the drift.
Which statement BEST describes the primary architectural difference between load balancing and clustering when both are used to achieve high availability?
Load balancing spreads incoming requests across multiple independent active nodes to improve throughput and availability, while clustering ties nodes together (often sharing state/storage) so that if one node fails, another can seamlessly take over — a distinct HA mechanism from simple traffic distribution.
A power utility's SCADA network must periodically transmit telemetry readings to a corporate reporting network, but the SCADA network must NEVER receive any inbound traffic from the corporate side, even in the event of a misconfiguration, to prevent malware ingress into the control system. Which control BEST enforces this requirement?
A data diode is a hardware device that physically permits data flow in only one direction, making reverse traffic physically impossible regardless of software misconfiguration — the strongest guarantee of unidirectional flow for SCADA-to-corporate telemetry.
Ready for the real thing?
The full course: two full-length practice tests, video lessons for every exam domain, hands-on labs and detailed explanations.
$109.99 $34.99 with code FREETEST33 — valid through September 2.
Get my $34.99 deal →