CompTIA Security+ Security Architecture Practice Questions

1. A company runs its web servers on virtual machines rented from an Infrastructure as a Service (IaaS) provider. Under the shared responsibility model, who is responsible for patching the guest operating systems?

Objective 3.1

Show answer

Answer: B. The customer

In IaaS the provider secures the physical hosts, network and hypervisor, while the customer manages the operating system and everything above it. The provider would patch the OS only in PaaS or SaaS, where it manages that layer.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

2. Which practice defines servers, networks and firewall rules in machine-readable template files so that environments can be deployed consistently and reviewed like source code?

Objective 3.1

Show answer

Answer: C. Infrastructure as code

Infrastructure as code describes infrastructure in files that can be version-controlled, reviewed and deployed the same way every time. Containerization packages applications with their dependencies but does not define the surrounding network and firewall infrastructure.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

3. A water treatment plant's control network must have no physical or wireless connection to any other network, including the corporate LAN and the internet. Which design meets this requirement?

Objective 3.1

Show answer

Answer: A. Air gap

An air-gapped network is physically isolated with no connection to other networks. VLANs separate traffic logically but still share switches and cabling with other networks, so they do not meet a no-connection requirement.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

4. An inline intrusion prevention system protects a payment network. Security policy says that if the IPS fails, no uninspected traffic may pass. How should the device's failure mode be configured?

Objective 3.2

Show answer

Answer: B. Fail-closed

Fail-closed blocks all traffic when the device fails, which keeps security at the cost of availability. Fail-open would let traffic flow uninspected during a failure, which the policy forbids.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

5. Administrators must not connect directly to servers in a restricted network segment. Instead, they connect to one hardened, closely monitored host and start their administrative sessions from there. What is that host called?

Objective 3.2

Show answer

Answer: C. Jump server

A jump server (bastion host) is the single controlled entry point for managing devices in a protected zone. A forward proxy relays users' outbound web requests; it is not a host for administrative access into a segment.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

6. Which standard requires a device to authenticate, usually against a RADIUS server, before a switch port or wireless network gives it network access?

Objective 3.2

Show answer

Answer: A. 802.1X

IEEE 802.1X is port-based network access control that uses EAP to authenticate devices before granting access. 802.1Q looks similar but is the standard for VLAN tagging and performs no authentication.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

7. Which IPsec mode encrypts the entire original IP packet, including its header, and places it inside a new IP packet, making it the usual choice for site-to-site VPNs?

Objective 3.2

Show answer

Answer: D. Tunnel mode

Tunnel mode wraps the whole original packet in a new one, hiding the internal addresses between the two gateways. Transport mode protects only the payload and keeps the original IP header.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

8. Customer records have been loaded into a server's RAM while an application calculates monthly bills. Which state is that data in?

Objective 3.3

Show answer

Answer: D. Data in use

Data being actively processed in memory or the CPU is data in use. Data at rest is data stored on disk; the same records were at rest before they were loaded into memory.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

9. An online store wants to stop storing real card numbers in its order database. Each card number is replaced with a random value, and only a separate, secured system can map that value back to the real number. Which technique is this?

Objective 3.3

Show answer

Answer: B. Tokenization

Tokenization swaps sensitive data for a meaningless token and keeps the mapping in a secure vault. Hashing is one-way with no lookup table, so the store could never recover the real number from it.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

10. A company stores EU customers' personal data only on servers inside the EU, because data is subject to the laws of the country where it is physically stored. Which concept does this describe?

Objective 3.3

Show answer

Answer: C. Data sovereignty

Data sovereignty means data is governed by the laws of the country where it physically resides. Geographic restrictions limit where users can access data from, not which country's laws apply to stored data.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

11. A small company needs a disaster recovery site on a tight budget. It can accept several weeks to become operational after a disaster, and the site only needs space, power and network connectivity, since equipment would be brought in after an event. Which option fits?

Objective 3.4

Show answer

Answer: D. Cold site

A cold site is the cheapest option: an empty facility with power and connectivity, which takes the longest to bring online. A warm site already has some hardware in place, costing more than this company needs to spend.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

12. Before applying a risky upgrade, an administrator wants to capture the exact state of a virtual machine within seconds so it can be rolled back if the upgrade fails. Which method is most appropriate?

Objective 3.4

Show answer

Answer: A. Snapshot

A snapshot records a VM's state at a point in time and allows a quick rollback. Replication continuously copies changes to another system, so it would copy the failed upgrade too.

Checked by Claude Opus 5.5 (high effort) · Oct 14, 2026

CompTIA Security+ · Domain 3 · 18% of the examSecurity Architecture

1. A company runs its web servers on virtual machines rented from an Infrastructure as a Service (IaaS) provider. Under the shared responsibility model, who is responsible for patching the guest operating systems?

2. Which practice defines servers, networks and firewall rules in machine-readable template files so that environments can be deployed consistently and reviewed like source code?

3. A water treatment plant's control network must have no physical or wireless connection to any other network, including the corporate LAN and the internet. Which design meets this requirement?

4. An inline intrusion prevention system protects a payment network. Security policy says that if the IPS fails, no uninspected traffic may pass. How should the device's failure mode be configured?

5. Administrators must not connect directly to servers in a restricted network segment. Instead, they connect to one hardened, closely monitored host and start their administrative sessions from there. What is that host called?

6. Which standard requires a device to authenticate, usually against a RADIUS server, before a switch port or wireless network gives it network access?

7. Which IPsec mode encrypts the entire original IP packet, including its header, and places it inside a new IP packet, making it the usual choice for site-to-site VPNs?

8. Customer records have been loaded into a server's RAM while an application calculates monthly bills. Which state is that data in?

9. An online store wants to stop storing real card numbers in its order database. Each card number is replaced with a random value, and only a separate, secured system can map that value back to the real number. Which technique is this?

10. A company stores EU customers' personal data only on servers inside the EU, because data is subject to the laws of the country where it is physically stored. Which concept does this describe?

11. A small company needs a disaster recovery site on a tight budget. It can accept several weeks to become operational after a disaster, and the site only needs space, power and network connectivity, since equipment would be brought in after an event. Which option fits?

12. Before applying a risky upgrade, an administrator wants to capture the exact state of a virtual machine within seconds so it can be rolled back if the upgrade fails. Which method is most appropriate?