CoStudy

HomeCertificationsCompTIA Security+ › Security Architecture

Security Architecture — CompTIA Security+ practice questions

54 multiple-choice questions and 53 flashcards on Security Architecture, about 18% of the CompTIA Security+ bank. Every one carries a written rationale.

Written and maintained by Nick Burton · last updated 2026-08-22 · how we write and review questions

What this chapter covers

Security Architecture is one of 6 chapters in CoStudy's CompTIA Security+ bank, and it holds 54 of the bank's 300 multiple-choice questions — roughly 18% of the total. That proportion is not arbitrary: chapters follow the certifying body's published exam outline, and the number of questions in each is set by that domain's published weight, so the share of your practice time this chapter takes matches the share of the real exam it accounts for.

Studying by chapter is worth doing once you have a diagnostic score. A single overall percentage tells you whether you are close; it does not tell you which domain is dragging. Working a weak chapter in isolation, and re-testing it in isolation, is the fastest way to move a score that has stalled — and it is why the mock exams in CoStudy report by domain rather than as one number.

Free Security Architecture practice questions

10 questions drawn from this chapter, with the full rationale shown — the controlling principle behind the right answer, and why each wrong option tempts and fails.

For data at rest, the recommended encryption is:

  1. RSA applied directly to the full data set on disk for confidentiality
  2. AES-256 for the bulk data, with RSA or ECC used only to wrap the key
  3. MD5 digests stored beside each file in place of any encryption
  4. Single DES in CBC mode applied across archived storage volumes

Answer: B — AES-256 for the bulk data, with RSA or ECC used only to wrap the key

(B) Hybrid encryption is standard: a fast symmetric cipher protects the bulk data and asymmetric cryptography protects the symmetric key. (A) is far too slow for bulk data. (C) is a hash and provides no confidentiality. (D) uses a deprecated 56-bit key.

A hybrid cloud deployment combines:

  1. Two public clouds from different providers
  2. On-premises virtualized resources only
  3. Two private clouds in separate facilities
  4. Public and private resources, orchestrated

Answer: D — Public and private resources, orchestrated

(D) Hybrid pairs public and private estates with integration between them. (A) is multi-cloud; (B) is purely on-premises; (C) is a distributed private cloud.

GCP's equivalent of AWS EC2 is:

  1. Cloud Storage
  2. Compute Engine
  3. Google BigQuery
  4. Cloud Pub/Sub

Answer: B — Compute Engine

(B) Compute Engine provides GCP virtual machines, matching AWS EC2. (A) is object storage like S3; (C) is the analytics warehouse; (D) is the messaging service.

How many bits is an IPv4 address?

  1. 32
  2. 16
  3. 64
  4. 128

Answer: A — 32

IPv4 = 32-bit. (B) is half; (C) is half-IPv6; (D) is IPv6.

RAID 10 (1+0) provides:

  1. Distributed parity only, with no mirroring
  2. Striped mirrors — mirroring plus striping
  3. A single disk with no redundancy at all
  4. Striping alone, with no fault tolerance

Answer: B — Striped mirrors — mirroring plus striping

(B) RAID 10 stripes across mirrored pairs, giving both speed and redundancy. (A) is RAID 5 or 6; (C) and (D) describe no redundancy at all.

Data classification (Public / Internal / Confidential / Restricted) primarily helps to:

  1. Reduce overall storage cost across the estate
  2. Apply handling controls based on sensitivity
  3. Comply with marketing and advertising rules
  4. Increase document share counts internally

Answer: B — Apply handling controls based on sensitivity

(B) Labels drive the access, encryption, retention, and disposal controls each tier requires. (A) may be a side effect at best; (C) and (D) are unrelated to protecting data.

RAID 1 provides:

  1. Striping with no fault tolerance at all
  2. Double parity across four or more disks
  3. Distributed parity across three or more disks
  4. Mirroring identical copies on paired disks

Answer: D — Mirroring identical copies on paired disks

(D) RAID 1 keeps a full duplicate, surviving one failure per mirror pair. (A) is RAID 0; (C) is RAID 5; (B) is RAID 6.

A WAF and an IPS overlap, but the key distinction is:

  1. WAF inspects HTTP semantics; IPS covers network-wide threats
  2. The WAF operates at layer 3 only, examining IP headers alone
  3. IPS protects only web applications, ignoring other traffic
  4. They are one product sold under two different vendor names

Answer: A — WAF inspects HTTP semantics; IPS covers network-wide threats

A) A WAF understands application-layer HTTP structure such as parameters, bodies, and sessions, while an IPS applies signature and behavioral detection across network traffic. B) That inverts the WAF's layer. C) IPS scope is far wider than web apps. D) They remain distinct products.

NIC teaming primarily provides:

  1. Aggregated bandwidth and link redundancy
  2. Encryption of traffic leaving the adapter
  3. DNS resolution offloaded to the adapter
  4. Power redundancy for the network adapter

Answer: A — Aggregated bandwidth and link redundancy

(A) Teaming bonds several NICs into one logical interface for throughput, failover, or both. (B), (C), and (D) are unrelated to link bonding.

A company labels documents as Public, Internal, Confidential, and Restricted. Who is primarily responsible for assigning the correct classification?

  1. The data custodian in IT, who implements storage controls
  2. The CISO, who signs off on every document label personally
  3. The data owner, the business unit accountable for the data
  4. The end user, who labels each file at the moment of creation

Answer: C — The data owner, the business unit accountable for the data

C) The data owner is the business-unit leader accountable for the data and assigns classification by sensitivity and business impact. A) Custodians implement the protections the classification demands. B) The CISO sets the scheme, not each label. D) Users apply handling rules that follow from the label.

Security Architecture flashcards

4 cards from the 53 in this chapter.

What is microsegmentation?

Granular network segmentation down to individual workloads. Controls east-west (lateral) traffic. Enables Zero Trust.

What is degaussing?

Using a strong magnetic field to erase data on magnetic media (HDDs, tapes). Renders the media unusable. Not effective on SSDs or flash storage.

What is IKE?

Internet Key Exchange — protocol used to establish a security association (SA) in IPsec. Handles key negotiation.

What is a business continuity plan (BCP)?

A broader plan ensuring critical business functions continue during and after a disaster. DRP is a subset of BCP.

Practise the full chapter

These are a sample. The full Security Architecture chapter runs 107 items with per-chapter progress tracking, on the web and in the iOS app.

Open CompTIA Security+ in CoStudy →

Other CompTIA Security+ chapters

All CompTIA Security+ practice questions →