Skip to main content
Offline·Progress is saved on this device and syncs the next time you open the app online.
Domain 3 practice

Security+ Domain 3 Practice Questions: Security Architecture

40 free CompTIA Security+ SY0-701 practice questions for Domain 3, Security Architecture, which is about 18% of the exam. Each question has the correct answer and a clear explanation. No account or signup needed.

Last updated August 2026

  1. Question 1

    Which device filters traffic between networks and tracks the state of active connections so it can allow return traffic for sessions it already approved?

    • AStateful firewall
    • BLayer 2 switch
    • CNetwork hub
    • DRepeater
    Show answer and explanation

    Correct answer: A. Stateful firewall

    A stateful firewall tracks connection state and permits return traffic for established sessions, unlike a stateless packet filter. Switches, hubs, and repeaters move traffic but do not enforce stateful policy.

  2. Question 2

    Which technology creates an encrypted tunnel so a remote employee can securely reach the corporate network over the public Internet?

    • ANAT
    • BDMZ
    • CVLAN
    • DVPN
    Show answer and explanation

    Correct answer: D. VPN

    A VPN (virtual private network) encrypts traffic in a tunnel across an untrusted network. A VLAN segments a LAN, NAT translates addresses, and a DMZ is an isolated subnet for public services.

  3. Question 3

    Which server sits between internal users and the Internet, forwarding their web requests on their behalf and able to cache and filter content?

    • AForward proxy
    • BJump server
    • CMail relay
    • DReverse proxy
    Show answer and explanation

    Correct answer: A. Forward proxy

    A forward proxy represents internal clients when they reach out to the Internet, adding caching and content filtering. A reverse proxy fronts internal servers for inbound clients, and a jump server is a hardened admin gateway.

  4. Question 4

    Encrypting information while it travels across a network protects data in which state?

    • AData in archive
    • BData in transit
    • CData at rest
    • DData in use
    Show answer and explanation

    Correct answer: B. Data in transit

    Data in transit is data moving across a network, protected by transport encryption such as TLS. Data at rest is stored data, and data in use is data actively being processed in memory.

  5. Question 5

    Under the cloud shared responsibility model for Infrastructure as a Service (IaaS), who is responsible for securing the data and applications the customer places in the cloud?

    • AThe customer
    • BThe Internet service provider
    • CAn independent auditor
    • DThe cloud provider
    Show answer and explanation

    Correct answer: A. The customer

    In IaaS, the provider secures the underlying infrastructure while the customer secures their operating systems, applications, and data. Responsibility is shared, but data and apps belong to the customer.

  6. Question 6

    Which technique distributes incoming requests across multiple backend servers to improve performance and avoid overloading any single one?

    • APort mirroring
    • BVLAN tagging
    • CLoad balancing
    • DNetwork address translation
    Show answer and explanation

    Correct answer: C. Load balancing

    A load balancer spreads traffic across multiple servers, supporting both performance and availability. Port mirroring copies traffic for monitoring, VLAN tagging labels segmented traffic, and NAT maps addresses.

  7. Question 7

    Which technology provides fault tolerance by mirroring or striping data across multiple physical disks so a single disk failure does not lose data?

    • AJournaling
    • BA nightly full backup
    • CRAID
    • DDeduplication
    Show answer and explanation

    Correct answer: C. RAID

    RAID combines disks for redundancy and performance so one drive can fail without data loss. Backups protect against larger loss but are not real-time fault tolerance, and journaling and deduplication serve other purposes.

  8. Question 8

    Which type of system directly controls physical industrial processes, such as a water treatment plant, and often runs legacy software that is hard to patch?

    • AA container registry
    • BA virtual desktop
    • CA standard web server
    • DICS/SCADA
    Show answer and explanation

    Correct answer: D. ICS/SCADA

    Industrial control systems (ICS), often managed by SCADA, run physical processes and are frequently legacy and fragile, requiring special protections such as isolation. The other options are general-purpose IT systems.

  9. Question 9

    Which technology packages an application with its dependencies to run in isolation on a shared host operating system kernel, without a full guest OS for each instance?

    • AContainerization
    • BA bare-metal server
    • CA storage area network
    • DA type 1 hypervisor virtual machine
    Show answer and explanation

    Correct answer: A. Containerization

    Containers share the host kernel and isolate applications with their dependencies, making them lightweight. A virtual machine runs a full guest OS on a hypervisor, which is heavier.

  10. Question 10

    To protect the confidentiality and integrity of data sent to a public web application, which protocol should be implemented?

    • ASNMPv1
    • BTelnet
    • CTLS (HTTPS)
    • DFTP
    Show answer and explanation

    Correct answer: C. TLS (HTTPS)

    TLS encrypts and authenticates web traffic (HTTPS), protecting it in transit. Telnet, FTP, and SNMPv1 all transmit data, including credentials, in cleartext.

  11. Question 11

    A company places many customers on the same physical cloud servers while isolating each tenant with logical controls. Which cloud characteristic creates the greatest risk that one tenant could affect another if isolation fails?

    • AMultitenancy
    • BElasticity
    • CMeasured service
    • DBroad network access
    Show answer and explanation

    Correct answer: A. Multitenancy

    Multitenancy shares infrastructure among customers, so weak isolation can leak data or resources between tenants. Elasticity scales capacity, measured service tracks usage, and broad network access describes remote reach, not shared-tenant risk.

  12. Question 12

    Developers deploy functions that run only when events occur and scale automatically without managing servers. Which architecture model is this, and what is a key security concern?

    • APeer-to-peer, direct client-to-client hosting
    • BMainframe, batch jobs on proprietary hardware
    • CBare metal, full OS control for every function
    • DServerless, short-lived instances that are hard to inspect
    Show answer and explanation

    Correct answer: D. Serverless, short-lived instances that are hard to inspect

    Serverless runs event-driven code without customer-managed servers, so traditional host monitoring is limited. Bare metal and mainframes are not ephemeral function models, and peer-to-peer is a different distribution pattern.

  13. Question 13

    Sensors process data near retail store devices so decisions happen with minimal delay before results are sent to a central cloud. Which model best describes this placement?

    • AAir-gapped offline processing
    • BMainframe computing
    • CClient-server only on the LAN
    • DEdge computing
    Show answer and explanation

    Correct answer: D. Edge computing

    Edge computing processes data close to the source to cut latency. Mainframes are centralized systems, LAN client-server does not imply local IoT-style processing, and air-gapped systems are isolated from networks.

  14. Question 14

    An application is split into many small services that communicate over APIs. Which security implication is most associated with this design?

    • ANo need to encrypt service-to-service traffic
    • BA larger network attack surface between services
    • CElimination of all authentication needs
    • DGuaranteed isolation from supply chain risk
    Show answer and explanation

    Correct answer: B. A larger network attack surface between services

    Microservices increase east-west API paths that must be authenticated and monitored. They do not remove auth, supply chain risk, or encryption needs.

  15. Question 15

    Under Platform as a Service, which task typically remains the customer's responsibility rather than the provider's?

    • AMaintaining the physical data center facilities
    • BReplacing failed rack power supplies
    • CSecuring application code and identity configuration
    • DPatching the underlying hypervisor host firmware
    Show answer and explanation

    Correct answer: C. Securing application code and identity configuration

    In PaaS the provider manages platform and host layers, while customers secure their apps, data, and access settings. Facility power, hypervisor hosts, and physical plant remain provider duties.

  16. Question 16

    An attacker escapes a virtual machine and executes code on the host that runs other VMs. Which component was primarily compromised?

    • AThe hypervisor
    • BA web proxy cache
    • CAn offline tape library
    • DA DNS resolver only
    Show answer and explanation

    Correct answer: A. The hypervisor

    VM escape targets the hypervisor that separates guests from the host. Proxy caches, DNS resolvers, and offline media are unrelated to guest isolation.

  17. Question 17

    Network policies and routing are controlled centrally through software rather than by configuring each switch by hand. Which technology is this?

    • ASoftware-defined networking (SDN)
    • BTime-division multiplexing
    • CToken ring bridging
    • DCircuit-switched telephony
    Show answer and explanation

    Correct answer: A. Software-defined networking (SDN)

    SDN separates the control plane so software defines network behavior centrally. The other options are older or unrelated networking concepts.

  18. Question 18

    A fleet of low-power building sensors cannot run full endpoint agents or frequent patch cycles. Which architecture concern is most relevant?

    • AConstrained devices with limited update and monitoring options
    • BBuilt-in support for full disk encryption always on
    • CAutomatic compliance with every enterprise GPO
    • DUnlimited local compute for heavy antivirus scans
    Show answer and explanation

    Correct answer: A. Constrained devices with limited update and monitoring options

    IoT and similar devices often lack CPU, memory, and update paths that desktops have. They rarely support full enterprise agent stacks or Group Policy by default.

  19. Question 19

    Administrators must manage production servers without exposing SSH directly to the Internet. Which control best provides a hardened intermediate access path?

    • AAnonymous FTP staging folder
    • BPublic RDP on every server
    • CJump server (bastion host)
    • DOpen recursive DNS on the edge
    Show answer and explanation

    Correct answer: C. Jump server (bastion host)

    A jump or bastion host is a controlled entry point for admin access. Open DNS, anonymous FTP, and public RDP expand exposure instead of reducing it.

  20. Question 20

    A security gateway loses power and must choose a default behavior. The organization prefers blocking traffic rather than allowing unknown flows. Which fail mode is required?

    • AFail-closed
    • BFail-open
    • CFail-shared with no policy
    • DFail-soft only for logging
    Show answer and explanation

    Correct answer: A. Fail-closed

    Fail-closed denies traffic when the control cannot operate safely. Fail-open permits traffic during failure, which increases risk for security-critical gateways.

  21. Question 21

    A team wants to inspect and block common web application attacks such as injection attempts before they reach application servers. Where should a web application firewall typically sit?

    • AAs a replacement for disk encryption
    • BOnly on offline backup media
    • CInside each end-user browser extension
    • DIn front of the web applications facing clients
    Show answer and explanation

    Correct answer: D. In front of the web applications facing clients

    A WAF is placed where it can see HTTP/S to applications and filter malicious requests. It does not protect backup media, live in browsers as a network control, or encrypt disks.

  22. Question 22

    After an initial foothold on one internal host, an attacker moves laterally between servers in the same data center. Which traffic path is this primarily?

    • AOutbound mail gateway traffic
    • BNorth-south Internet edge only
    • CEast-west traffic
    • DExtranet partner VPN solely
    Show answer and explanation

    Correct answer: C. East-west traffic

    East-west is internal server-to-server movement. North-south is client or Internet to data center edge, not lateral movement among internal systems.

  23. Question 23

    A switch port should allow only a known workstation MAC and shut down if another device is plugged in. Which feature implements this?

    • APort security
    • BLLDP neighbor discovery
    • CSpanning tree root guard only
    • DDHCP snooping without MAC limits
    Show answer and explanation

    Correct answer: A. Port security

    Port security binds allowed MACs to a switch port and can disable the port on violation. The other features solve different Layer 2 problems.

  24. Question 24

    Network devices currently use SNMPv2c with a shared community string in clear text. Which change most improves management protocol security?

    • AMigrate to SNMPv3 with authentication and encryption
    • BPublish community strings in DNS TXT records
    • CSwitch to Telnet for device management
    • DDisable all logging of configuration changes
    Show answer and explanation

    Correct answer: A. Migrate to SNMPv3 with authentication and encryption

    SNMPv3 adds authentication and privacy that SNMPv2c lacks. Telnet is clear text, and disabling logging or publishing secrets worsens security.

  25. Question 25

    A company wants cloud-delivered secure web access, CASB-style SaaS control, and private app access without full traditional VPN backhaul. Which approach best matches this design?

    • ASecure Access Service Edge (SASE)
    • BUnfiltered public Wi-Fi bridges
    • CLegacy hub-and-spoke only with no cloud security
    • DStandalone dial-up RAS
    Show answer and explanation

    Correct answer: A. Secure Access Service Edge (SASE)

    SASE combines network and security services at the cloud edge for users and apps. Dial-up RAS and open Wi-Fi do not provide that integrated model.

  26. Question 26

    A research lab network has no physical or logical links to any other network, including the Internet. Which isolation method is this?

    • AAir gap
    • BContent delivery network peering
    • CVLAN trunking across sites
    • DSplit tunnel VPN
    Show answer and explanation

    Correct answer: A. Air gap

    An air gap means intentional complete isolation. VLANs, split tunnel VPN, and CDN peering still involve connectivity paths.

  27. Question 27

    Database files on disk are encrypted so that stolen hard drives do not expose readable records. Which data state is primarily protected?

    • AData in use in CPU registers only
    • BData at rest
    • CData in motion across a VPN only
    • DData in transit
    Show answer and explanation

    Correct answer: B. Data at rest

    Data at rest is stored data on media. Transit and motion describe data moving on networks, and in-use focuses on data being processed in memory.

  28. Question 28

    An application must keep a secret key available while it processes transactions in memory, yet limit exposure if memory is dumped. Which protection strategy best targets this state?

    • ASecure enclaves or memory encryption for data in use
    • BOffsite tape rotation schedules
    • CTLS only on external DNS queries
    • DPaper shredding of printed reports
    Show answer and explanation

    Correct answer: A. Secure enclaves or memory encryption for data in use

    Data in use needs runtime protections such as enclaves or memory encryption. TLS, shredding, and tape rotation address other states or media.

  29. Question 29

    Regulators require that citizen personal data remain stored and processed inside a specific country. Which data protection concept is this requirement enforcing?

    • AData sovereignty
    • BHashing of every log line
    • CTokenization of all backups
    • DData minimization only
    Show answer and explanation

    Correct answer: A. Data sovereignty

    Data sovereignty ties storage and processing to legal jurisdictions. Minimization, tokenization, and hashing are useful controls but do not define location rules.

  30. Question 30

    A support dashboard shows only the last four digits of customer account numbers while hiding the rest from agents. Which technique is this?

    • ASteganography
    • BSymmetric key escrow
    • CFull disk encryption
    • DData masking
    Show answer and explanation

    Correct answer: D. Data masking

    Masking conceals parts of sensitive fields for display. Full disk encryption protects whole volumes, steganography hides messages in media, and key escrow stores keys with a third party.

  31. Question 31

    Before disposing of encrypted drives, the team destroys the encryption keys so ciphertext cannot be recovered. What is this sanitization approach called?

    • AFile defragmentation
    • BWarm site replication
    • CCryptographic erasure
    • DLow-level formatting only
    Show answer and explanation

    Correct answer: C. Cryptographic erasure

    Cryptographic erasure makes data unreadable by destroying keys. Formatting or defrag is not reliable sanitization, and warm site replication is a recovery design.

  32. Question 32

    Cloud object storage is configured so objects may be created only in approved regions and cannot be copied to disallowed locations. Which control type is this primarily?

    • AGeographic or geofencing restrictions
    • BPassword complexity rules
    • CScreen lock timeouts
    • DCable locks on laptops
    Show answer and explanation

    Correct answer: A. Geographic or geofencing restrictions

    Geographic restrictions limit where data may reside or move. Password, screen lock, and cable lock controls protect endpoints and accounts, not data location policy.

  33. Question 33

    An organization needs a recovery facility with fully mirrored systems and near-immediate cutover after a primary site disaster. Which site type fits best?

    • AHot site
    • BMobile media vault without compute
    • CCold site
    • DWarm site with partial hardware only
    Show answer and explanation

    Correct answer: A. Hot site

    Hot sites are ready to run production quickly with live or near-live capacity. Cold sites need extensive setup, warm sites are partial, and media vaults store data without full compute.

  34. Question 34

    Nightly backups copy only files that changed since the previous backup job of any type, creating a chain of small backups between fulls. Which backup type is this?

    • AIncremental backup
    • BSynthetic differential only
    • CFull backup every night
    • DMirror without history
    Show answer and explanation

    Correct answer: A. Incremental backup

    Incremental backups capture changes since the last backup of any kind. Full copies everything, and differentials copy since the last full, not since each prior job.

  35. Question 35

    During a brief utility outage, servers keep running long enough for a clean shutdown or generator start. Which device provides this short-term power?

    • AContent filter appliance
    • BUninterruptible power supply (UPS)
    • CHardware security module
    • DNetwork tap
    Show answer and explanation

    Correct answer: B. Uninterruptible power supply (UPS)

    A UPS bridges short power gaps with battery power. Taps, HSMs, and content filters serve monitoring, crypto, or web filtering roles.

  36. Question 36

    Critical systems are duplicated in data centers hundreds of miles apart so a regional outage does not take down all capacity. Which resilience strategy is this?

    • AGeographic dispersal
    • BLocal host NIC teaming alone
    • CSingle rack clustering only
    • DSame-building dual PSUs only
    Show answer and explanation

    Correct answer: A. Geographic dispersal

    Geographic dispersal spreads risk across distant locations. Local clustering, NIC teaming, and dual PSUs help within one site but not regional disasters.

  37. Question 37

    Before a major OS upgrade, an administrator captures the current virtual machine state so the system can return quickly if the upgrade fails. What was created?

    • AA certificate revocation list
    • BA snapshot
    • CA cold site contract
    • DA legal hold archive
    Show answer and explanation

    Correct answer: B. A snapshot

    Snapshots record a point-in-time VM or volume state for quick rollback. Cold sites, legal holds, and CRLs serve recovery facilities, litigation, and PKI, not OS upgrade rollback.

  38. Question 38

    Two identical firewalls are deployed so one handles live traffic while the other waits and takes over if the primary fails. Which high-availability mode is this?

    • ARound-robin DNS without failover
    • BStandalone with no secondary
    • CActive-passive
    • DActive-active load share only
    Show answer and explanation

    Correct answer: C. Active-passive

    Active-passive keeps a standby ready to assume the role of the primary. Active-active runs both concurrently, and DNS or standalone setups lack true appliance failover pairing.

  39. Question 39

    Backups complete every night, but nobody has restored a sample file in over a year. Which resilience practice is most urgently missing?

    • ADisabling backup encryption for speed
    • BDeleting older recovery points automatically forever
    • CStoring all copies only on the same production array
    • DRegular restore testing to verify recoverability
    Show answer and explanation

    Correct answer: D. Regular restore testing to verify recoverability

    Untested backups may fail when needed, so restore drills validate them. Weakening encryption, same-array-only copies, and aggressive deletion increase risk.

  40. Question 40

    A company rents empty floor space with power and network jacks but will install servers and restore data only after a disaster is declared. Which site type is this?

    • AHot site
    • BAlways-on multipath SAN
    • CCold site
    • DMirrored active-active pair
    Show answer and explanation

    Correct answer: C. Cold site

    Cold sites provide basic facilities without ready systems. Hot and active-active designs keep capacity running, and multipath SANs address storage path resilience, not empty recovery space.

Master every domain

A free account opens all of Domain 1: a lesson, a hands-on lab and a graded question bank on every objective, plus a placement check and a dated plan. No card.

Create a free accountSee plans

FAQ

  • Are these Security+ Domain 3 practice questions free?
    Yes. Every question on this page is free, with the correct answer and an explanation. No account, payment, or download is required.
  • How much of the Security+ exam is Domain 3?
    Domain 3, Security Architecture, accounts for about 18% of the CompTIA Security+ SY0-701 exam.

Practice another domain

Original practice questions aligned to the CompTIA Security+ SY0-701 objectives. CompTIA and Security+ are trademarks of CompTIA, used here for identification only.