Mock Exam Part 2: Security Architecture and Infrastructure

Welcome to Mock Exam Part 2, targeting Security+ Domain 3: Security Architecture (18% of the exam). This domain tests your ability to apply security controls to network and cloud infrastructure designs, understand segmentation and isolation strategies, evaluate protocol security, and recommend appropriate architectures for given scenarios. Architectural questions often present a network diagram or system description and ask you to identify the missing control, the vulnerable configuration, or the best design choice. Read each scenario carefully and identify the key architectural element being tested before selecting your answer.

Question: A company hosts a public web server and an internal database server. The security team wants to ensure that if the web server is compromised, attackers cannot directly access the internal database. What network design achieves this?

Answer: Place the web server in a DMZ (Demilitarized Zone) separated from the internal network by a second firewall. A DMZ uses two firewalls: the outer firewall separates the internet from the DMZ, and the inner firewall separates the DMZ from the internal network. Even if the web server is fully compromised, the inner firewall blocks direct access to the internal database — the attacker must break through a second firewall. Placing both servers in the same network segment removes this protection. A single firewall with different ports for web and database traffic is insufficient — a compromised web server can reach database ports from the same segment.

Question: A security team wants to detect network attacks and automatically block malicious traffic before it reaches internal servers. Which device type BEST meets both requirements?

Answer: Intrusion Prevention System (IPS). An IPS sits inline in the traffic path, can detect attacks (like IDS), and can also actively block malicious traffic. An IDS (Intrusion Detection System) is typically deployed out-of-band (traffic is mirrored to it) — it detects and alerts but cannot block traffic since it is not in the traffic path. Both use signature-based and anomaly-based detection. The risk of IPS is false positives blocking legitimate traffic — this is why IPS requires careful tuning. NIDS (Network) vs HIDS (Host-based): network placement detects traffic; host-based analyzes system events on a specific host.

Question: An organization has remote workers accessing corporate resources from home networks. The traditional VPN allows any connected device full access to the internal network. What zero trust architecture alternative BEST reduces the risk of lateral movement if a remote device is compromised?

Answer: Replace the VPN with Zero Trust Network Access (ZTNA) that grants per-application access based on device health, user identity, and context. Traditional VPN grants broad network access (once connected, the device can reach most internal resources). ZTNA enforces the zero trust principle: each resource access request is individually evaluated based on user identity, device compliance (patching, certificate), and risk context. A compromised device only has access to the specific applications its session was granted — not the entire network. This limits lateral movement to the blast radius of those applications rather than the whole corporate network.

Question: A company stores customer data in AWS S3 buckets. Who is responsible for ensuring the S3 bucket does not allow public access?

Answer: The customer (the company). Under the AWS shared responsibility model, AWS secures the physical infrastructure, hypervisor, and storage hardware. The customer is responsible for data classification and protection, S3 bucket policies and ACLs, access control, and compliance. Misconfigured S3 buckets (public-read or public-write) have caused some of the largest data breaches in history — all of which were the customer's responsibility to configure correctly. AWS provides tools (S3 Block Public Access, AWS Config rules, Amazon Macie) to help customers meet their responsibilities, but using them is the customer's choice.

Question: A network administrator segments the corporate network into VLANs: one for employee workstations, one for servers, one for IP cameras, and one for guest Wi-Fi. What security benefit does this provide?

Answer: Limits lateral movement — a compromise of one VLAN does not automatically grant access to other VLANs. VLANs provide logical network separation even on shared physical switches. Traffic between VLANs must pass through a router or Layer 3 switch where ACLs can be applied to restrict communication. If IoT cameras (a common attack target with weak security) are on a separate VLAN, a compromised camera cannot directly attack workstations or servers. Guest Wi-Fi VLAN isolation prevents guest users from accessing corporate resources. Note: VLANs are not a complete security boundary — VLAN hopping attacks exist, so they should be combined with physical segmentation for high-security zones.

Question: A network engineer needs to remotely manage routers and switches from a management workstation. Which protocol should they use to ensure all management traffic is encrypted?

Answer: SSH (Secure Shell) on port 22. SSH encrypts all traffic including credentials and commands. The insecure alternative, Telnet (port 23), transmits all data in plaintext — a network observer can capture login credentials. For web-based management interfaces, HTTPS (port 443) should replace HTTP. For SNMP monitoring, SNMPv3 with authentication and privacy (AES encryption) replaces the cleartext SNMPv1/v2c. The Security+ exam frequently presents tables comparing secure and insecure protocol pairs: always choose SSH over Telnet, SFTP over FTP, LDAPS over LDAP, HTTPS over HTTP, SNMPv3 over SNMPv1/v2.

Question: An organization wants a firewall that can inspect encrypted HTTPS traffic for malware, apply application-layer controls (blocking social media but allowing business applications), and integrate with a threat intelligence feed. What type of firewall should they deploy?

Answer: Next-Generation Firewall (NGFW). A NGFW operates at Layers 3-7 and includes: deep packet inspection (DPI) of application traffic, SSL/TLS inspection (decrypt, inspect, re-encrypt), application awareness (identify and control specific applications regardless of port), integrated IPS, and threat intelligence integration. Traditional stateful firewalls operate at Layers 3-4 (IP and TCP/UDP) — they can allow/block based on IP, port, and protocol but cannot distinguish between legitimate HTTPS and malware-over-HTTPS. Packet filtering firewalls are even more limited — stateless, no connection tracking.

Q8 — HA vs Fault Tolerance: A hospital requires zero-downtime if one server fails. Answer: Active-active fault-tolerant cluster — multiple servers handle requests simultaneously; one failure doesn't interrupt service. High availability has a brief failover period; active-passive has standby downtime. Zero downtime = active-active.

Q9 — Micro-Segmentation: 50 microservices — prevent lateral movement if one is compromised. Answer: Kubernetes NetworkPolicy or service mesh with mTLS — granular workload-level rules. VLANs are too coarse; mTLS adds encryption and mutual authentication between services.

Q10 — WPA3: Upgrade from WPA2-Personal to WPA3-Personal. Answer: SAE (Simultaneous Authentication of Equals) prevents offline dictionary attacks (attacker must interact with network per guess) and provides forward secrecy (unique session keys even if PSK is later compromised).

Honeynet: Network of honeypots to attract and study attackers while gathering threat intelligence. Air gap: Complete physical isolation from all external networks — no internet, no wireless, no removable media (theoretically). Proxy vs Reverse Proxy: Forward proxy controls outbound client traffic to internet; reverse proxy sits in front of servers, controls inbound, hides server topology. NAC (Network Access Control): Enforces AV, patching, and policy compliance before granting network access. CASB: Cloud Access Security Broker — policy enforcement point between cloud users and cloud providers. Split tunneling risk: Only corporate traffic goes through VPN tunnel; internet traffic bypasses it, creating bridging risk between corporate network and internet simultaneously.

SASE: Secure Access Service Edge — combines ZTNA, CASB, SWG, and FWaaS with SD-WAN as a unified cloud service for secure remote access. SDN security advantage: Separates control and data planes, enabling centralized, programmable security policy enforcement. Container security primary risk: Shared kernel — a container escape or kernel vulnerability compromises the host and all other containers. Jump server/bastion host: Single hardened access path to sensitive segments — all admin sessions must go through it and are logged. Wildcard TLS certificate risk: One compromised private key affects all *.domain.com subdomains. 802.1X port-based auth: Requires device authentication before any traffic is permitted from a switch port — prevents rogue devices from gaining network access.

Test your understanding of CompTIA Security+ (SY0-701) concepts from this lesson.

In this mock exam part you reviewed: DMZ architecture and how dual-firewall designs contain web server compromises from reaching internal networks, firewall type distinctions (packet filtering vs stateful vs NGFW with SSL inspection), and cloud and zero trust architecture — the shared responsibility boundary in cloud, ZTNA replacing VPN, and micro-segmentation for east-west traffic control. These architecture concepts represent the 18% Domain 3 content. Next up is Mock Exam Part 3 covering Operations, Incident Response, and Forensics.