Home › Certifications › CompTIA Security+ › Security Architecture
54 multiple-choice questions and 53 flashcards on Security Architecture, about 18% of the CompTIA Security+ bank. Every one carries a written rationale.
Security Architecture is one of 6 chapters in CoStudy's CompTIA Security+ bank, and it holds 54 of the bank's 300 multiple-choice questions — roughly 18% of the total. That proportion is not arbitrary: chapters follow the certifying body's published exam outline, and the number of questions in each is set by that domain's published weight, so the share of your practice time this chapter takes matches the share of the real exam it accounts for.
Studying by chapter is worth doing once you have a diagnostic score. A single overall percentage tells you whether you are close; it does not tell you which domain is dragging. Working a weak chapter in isolation, and re-testing it in isolation, is the fastest way to move a score that has stalled — and it is why the mock exams in CoStudy report by domain rather than as one number.
10 questions drawn from this chapter, with the full rationale shown — the controlling principle behind the right answer, and why each wrong option tempts and fails.
For data at rest, the recommended encryption is:
Answer: B — AES-256 for the bulk data, with RSA or ECC used only to wrap the key
(B) Hybrid encryption is standard: a fast symmetric cipher protects the bulk data and asymmetric cryptography protects the symmetric key. (A) is far too slow for bulk data. (C) is a hash and provides no confidentiality. (D) uses a deprecated 56-bit key.
A hybrid cloud deployment combines:
Answer: D — Public and private resources, orchestrated
(D) Hybrid pairs public and private estates with integration between them. (A) is multi-cloud; (B) is purely on-premises; (C) is a distributed private cloud.
GCP's equivalent of AWS EC2 is:
Answer: B — Compute Engine
(B) Compute Engine provides GCP virtual machines, matching AWS EC2. (A) is object storage like S3; (C) is the analytics warehouse; (D) is the messaging service.
How many bits is an IPv4 address?
Answer: A — 32
IPv4 = 32-bit. (B) is half; (C) is half-IPv6; (D) is IPv6.
RAID 10 (1+0) provides:
Answer: B — Striped mirrors — mirroring plus striping
(B) RAID 10 stripes across mirrored pairs, giving both speed and redundancy. (A) is RAID 5 or 6; (C) and (D) describe no redundancy at all.
Data classification (Public / Internal / Confidential / Restricted) primarily helps to:
Answer: B — Apply handling controls based on sensitivity
(B) Labels drive the access, encryption, retention, and disposal controls each tier requires. (A) may be a side effect at best; (C) and (D) are unrelated to protecting data.
RAID 1 provides:
Answer: D — Mirroring identical copies on paired disks
(D) RAID 1 keeps a full duplicate, surviving one failure per mirror pair. (A) is RAID 0; (C) is RAID 5; (B) is RAID 6.
A WAF and an IPS overlap, but the key distinction is:
Answer: A — WAF inspects HTTP semantics; IPS covers network-wide threats
A) A WAF understands application-layer HTTP structure such as parameters, bodies, and sessions, while an IPS applies signature and behavioral detection across network traffic. B) That inverts the WAF's layer. C) IPS scope is far wider than web apps. D) They remain distinct products.
NIC teaming primarily provides:
Answer: A — Aggregated bandwidth and link redundancy
(A) Teaming bonds several NICs into one logical interface for throughput, failover, or both. (B), (C), and (D) are unrelated to link bonding.
A company labels documents as Public, Internal, Confidential, and Restricted. Who is primarily responsible for assigning the correct classification?
Answer: C — The data owner, the business unit accountable for the data
C) The data owner is the business-unit leader accountable for the data and assigns classification by sensitivity and business impact. A) Custodians implement the protections the classification demands. B) The CISO sets the scheme, not each label. D) Users apply handling rules that follow from the label.
4 cards from the 53 in this chapter.
What is microsegmentation?
Granular network segmentation down to individual workloads. Controls east-west (lateral) traffic. Enables Zero Trust.
What is degaussing?
Using a strong magnetic field to erase data on magnetic media (HDDs, tapes). Renders the media unusable. Not effective on SSDs or flash storage.
What is IKE?
Internet Key Exchange — protocol used to establish a security association (SA) in IPsec. Handles key negotiation.
What is a business continuity plan (BCP)?
A broader plan ensuring critical business functions continue during and after a disaster. DRP is a subset of BCP.
These are a sample. The full Security Architecture chapter runs 107 items with per-chapter progress tracking, on the web and in the iOS app.
Open CompTIA Security+ in CoStudy →