Domain 3: Security Architecture

Why This Domain Matters

Domain 3 covers network and system architecture — firewalls, VPNs, segmentation, high availability, DMZs — plus modern vocabulary like cloud responsibility matrices, IaC, SASE, and SD-WAN, and data-classification language close to what regulated and legal-sector organizations deal with day to day.

Treat this domain as learn-from-scratch with occasional déjà vu even with prior networking exposure: half-remembered networking is more dangerous on exam day than none, because the distractors are built to catch it.

Before starting this domain, work through the networking primer to rebuild IP addressing, ports, and VLAN fundamentals — then study every section here fully.

Objective-by-Objective Breakdown

3.1 Architecture Models

Cloud — the shared responsibility matrix shifts by service model: in IaaS you own the OS, applications, and data while the provider owns physical infrastructure and the hypervisor; in PaaS the provider also manages the OS/runtime, leaving you the application and data; in SaaS the provider manages nearly everything except your data and who has access to it.

Third-party vendors extend your trust boundary (and your risk) into whatever the vendor does with your data.

IaC (infrastructure as code) defines infrastructure through version-controlled templates rather than manual configuration — consistent, repeatable, reviewable before deployment, but a misconfiguration or embedded secret now replicates at scale instead of on one box.

Serverless (FaaS) runs code without you managing the underlying server — shrinks OS-patching responsibility but shifts it to correctly scoping each function's permissions.

Microservices break an application into small, independently deployable services talking over APIs — smaller blast radius per service, but many more API endpoints to secure. [All three: NEW.]

On-premises vs. cloud, centralized vs. decentralized administration is a cost/control trade-off common in the field.

Containerization (OS-level virtualisation sharing the host kernel — lightweight, fast to deploy, but a kernel-level escape affects every container on the host) vs. virtualization (full VMs, each with its own OS under a hypervisor — heavier, but a stronger isolation boundary).

IoT, ICS/SCADA (industrial control systems prioritising availability of a physical process over confidentiality, frequently unpatchable without shutting down production), RTOS (an OS guaranteeing processing within a fixed time window, used where timing failure is itself a safety issue), and embedded systems (purpose-built, fixed-function, resource-constrained, often unpatched for the device's entire life) — the unifying idea, "this thing can't take a Defender agent," will feel familiar from supporting any legacy hardware in the field.

High availability — designing for continuous operation through redundancy, so no single component failure takes the service down.

Considerations checklist (the exam's favourite trade-off framing across every model above): availability, resilience, cost, responsiveness, scalability, ease of deployment, risk transference (shifting risk to a third party — e.g., insurance or a cloud provider's SLA), ease of recovery, patch availability, inability to patch, power, and compute.

Any architecture question can be reframed as "which of these twelve did the stem just describe?"

3.2 Secure Enterprise Infrastructure

Infrastructure considerations: device placement and security zones — a security zone is a network segment with one trust level; the classic three are the internet (untrusted), the internal LAN (trusted), and the DMZ/screened subnet between them, where public-facing servers live so a compromise there doesn't reach the internal network.

Attack surface (everything reachable — minimise by killing unused services), connectivity, and failure modes: fail-open (allows traffic through on failure — prioritises availability) vs. fail-closed (blocks traffic on failure — prioritises confidentiality/integrity).

Device attribute: active (can act on traffic — e.g., block it) vs. passive (only observes), and separately inline (physically sits in the traffic path) vs. tap/monitor (receives a mirrored copy of traffic, out of path).

These two pairs usually travel together — an IPS is active+inline, a tap-fed IDS is passive+monitor — but the exam can test either dimension alone, so don't treat them as one concept.

Learn each appliance's one-line role — "which appliance goes here?" questions are common.

Port security: 802.1X (port-based network access control — a device plugged into a switch port or joining Wi-Fi gets no network access at all until it authenticates) and EAP (the authentication framework 802.1X rides on, with multiple certificate- or credential-based methods).

Firewall types: a Layer 4 firewall filters on IP address, port number, and protocol — it can see where traffic is going but not what's inside it. A Layer 7 firewall inspects the application-layer content itself — the actual HTTP request, the actual file.

WAF is a Layer-7-only firewall purpose-built to protect web applications from web attacks (SQLi, XSS). UTM bundles several security functions (firewall, IPS, AV, content filtering) into one appliance under one console — convenient, but a single point of failure.

Secure communication/access: a VPN creates an encrypted tunnel over an untrusted network so remote traffic is protected in transit.

Two tunneling families to study properly: TLS (the encryption behind HTTPS, also used for user-friendly remote-access VPNs) and IPsec (network-layer encryption for site-to-site and client VPNs — know that it has two modes: tunnel mode encrypts the whole original packet, transport mode encrypts only the payload).

SD-WAN centralises control of an organisation's wide-area links with application-aware routing and built-in security functions at the WAN edge, replacing branch-office hardware firewalls.

SASE is the cloud-delivered convergence of SD-WAN networking with a security stack (secure web gateway, CASB, ZTNA, firewall-as-a-service) for a distributed workforce — a favourite exam term for modern architecture questions.

Selection of effective controls always comes back to the 3.1 considerations checklist matched against the asset being protected — cost and ease of deployment matter as much as raw security strength.

3.3 Data Protection Concepts and Strategies

Data types: regulated (governed by specific law — e.g., health or financial privacy legislation), trade secret, intellectual property, legal information (privileged communications, case files, legal work product — the kind of data legal and professional-services organizations exist to protect), financial information, human-readable (plain text, directly understandable) vs. non-human-readable (binary/encoded, needs processing to interpret).

In practice, client case files and privileged legal correspondence sit at the "restricted/confidential" end regardless of which exact label scheme a stem uses — expect scenario questions to hand you a label and ask what control it implies, not to ask you to rank the six labels against each other.

Data sovereignty (data is subject to the laws of whatever country it physically resides in) and geolocation (knowing/verifying/restricting based on physical location — the mechanism that enforces sovereignty).

3.4 Resilience and Recovery in Security Architecture

High availability: load balancing distributes live traffic across multiple active, largely independent nodes for performance and uptime; clustering joins multiple servers into a single logical system with shared state, so one node can take over for a failed peer. See Confusables.

Geographic dispersion spreads sites across regions so one disaster (flood, cyclone — relevant living in Darwin) can't take out every site at once.

Platform diversity (different vendors/technology for redundant systems, so one vulnerability doesn't take down every instance), multi-cloud (spreading across providers to avoid single-vendor lock-in/outage exposure), continuity of operations (keeping essential functions running through a disruption), capacity planning across people (trained staff available during an event), technology (systems sized to absorb failover load), and infrastructure (physical facilities/power/network headroom).

Power: generators (fuel-based, sustain operations through a prolonged outage) and UPS (battery-based, bridges the short gap until generator power kicks in or enables a graceful shutdown).

Acronym Table

Drills: 20 flashcards + 10 exam-realistic questions, at the end of this page.