CompTIA SecurityX (CAS-005): Security Architecture

Click Here to Return To the CompTIA SecurityX Course Page #

Security Architecture is 27% of the CompTIA SecurityX (CAS-005) exam, the second-heaviest domain and the one that shapes all others. This domain covers how you design systems that stay available, resist attack, and recover quickly. At 27% and feeding directly into Security Engineering, spend solid time on Zero Trust, cloud architecture, and secure SDLC here.

An architect makes trade-offs leadership can accept. You balance security against cost, performance, and usability, then place each control where it provides the most value. If Governance sets the risk appetite, Architecture decides how to satisfy it.

Designing Resilient Systems #

Network Security Component Placement #

You place controls where traffic flows so each inspects the traffic it is designed to handle.

Network Topology Patterns #

The layout of your network defines what attackers can reach after compromising one component.

• A DMZ (demilitarized zone) sits between two firewalls. Internet-facing servers — web, email, DNS — live here, isolated so a DMZ breach does not reach internal assets.
• A screened subnet uses a single firewall with three interfaces. Simpler but provides less depth.
• Air-gapped networks have no electronic connection to untrusted networks. Required for classified environments and critical infrastructure control systems.
• VLANs segment a flat network into logical zones, limiting lateral movement without new hardware.

Availability and Integrity Design #

A single point of failure ends availability. You engineer it out through redundancy.

• Load balancing distributes traffic across servers, removes single points of failure, and enables rolling deploys.
• Active-active clustering runs all nodes simultaneously and shares load. Highest availability, highest cost.
• Active-passive clustering keeps standby nodes for automatic failover. Lower cost, brief failover delay.
• Recoverability requires tested backups and runbooks. Untested backups are assumptions, not assets.
• Interoperability uses open standards so heterogeneous components integrate without re-architecture.
• Vertical scaling adds RAM or CPU to one server. Fast but limited.
• Horizontal scaling adds servers behind a load balancer. Scales further but requires stateless application design.

Active-active provides better performance under load. Active-passive provides simpler failover logic. The exam will present scenarios where you choose one — match availability requirement to cost.

Security Throughout the Systems Life Cycle #

Application Security Testing in the Pipeline #

You shift security left so defects are corrected when they cost the least to fix.

The CI/CD pipeline itself is a high-value attack target because it has build and deploy authority. You protect it by requiring signed commits, limiting access to secrets, enforcing branch protection, and scanning pipeline configurations.

You generate an SBOM (Software Bill of Materials) for every release so you can quickly identify and patch when a transitive dependency has a new CVE.

Supply Chain and Hardware Assurance #

You verify software and hardware integrity across the supply chain.

• Signed software uses code signing to prove provenance and detect tampering.
• Hardware attestation uses TPM measurements to verify hardware has not been replaced with counterfeits.
• End-of-life planning schedules hardware replacement before vendor support ends, removing unpatched risk.
• Secure boot process validates firmware and bootloader signatures before executing them.

Zero Trust Architecture #

Zero Trust removes implicit trust based on network location. You verify every request using identity, device posture, and context. The principle is: never trust, always verify.

In Zero Trust, subject-object relationships define which identities (subjects) may perform which actions on which resources (objects). Access is granted at the smallest possible scope for the shortest necessary time.

Policy Decision and Enforcement Points #

Zero Trust frameworks separate two roles:

• Policy Decision Point (PDP) evaluates access requests against policy.
• Policy Enforcement Point (PEP) enforces the decision close to the resource.

An attacker who compromises a workload in a Zero Trust environment can only reach what that workload’s identity is permitted to reach — not the entire flat network.

Cloud Security Architecture #

You design cloud capabilities consistent with the shared responsibility model: the cloud provider secures the physical infrastructure and managed services; you secure the configuration, data, and access.

For a direct cloud provider comparison, see AWS vs Azure vs Google Cloud .

Multi-Cloud and Hybrid Design #

Multi-cloud introduces sprawl and inconsistent identity. You address it by:

• Federating identity so users authenticate once and reach all clouds.
• Maintaining a consistent network security policy across providers using infrastructure as code.
• Centralizing logging and monitoring so you have one view of events across environments.

Access, Authentication, and Authorization #

Identity Federation and SSO #

You design identity so employees authenticate once and access all systems.

• Federation extends trust across organizational boundaries using SAML assertions or OIDC tokens. A healthcare provider can federate with a partner lab without sharing passwords.
• SSO lets a user authenticate once to an IdP and receive a token accepted by all connected apps.
• SCIM (System for Cross-domain Identity Management) automates user provisioning and deprovisioning across systems so a terminated employee loses access everywhere within minutes.

Authorization Models #

ABAC is the most flexible model. It can incorporate time of day, device posture, and data classification into a single access decision. The exam may present a scenario where coarse RBAC is insufficient and ABAC is the correct answer.

PKI Architecture #

You design a certificate hierarchy that balances security with operational manageability.

• A root CA sits offline and signs only intermediate CA certificates. Keeping it offline protects the root key.
• Intermediate CAs issue end-entity certificates and can be revoked without replacing the root.
• Certificate revocation uses CRL (Certificate Revocation List) or OCSP (Online Certificate Status Protocol).
• OCSP stapling lets a web server attach a signed, pre-fetched OCSP response to the TLS handshake, eliminating the delay of a client making its own revocation check.

# Check OCSP stapling on a live server
openssl s_client -connect example.com:443 -status -servername example.com </dev/null 2>/dev/null \
  | grep -A 5 "OCSP"

Data Security Design #

You protect data by classifying it and controlling where it goes.

• Data labeling tags data at creation or classification so controls apply automatically as data moves.
• DLP (Data Loss Prevention) monitors data in use, in motion, and at rest, blocking transfers that violate policy.
• IRM / DRM (Information Rights Management) enforces access policy inside documents regardless of where they travel.
• Third-party data sharing requires contractual controls and technical enforcement such as API-level inspection.

Privacy by Design #

You integrate privacy into system design from the start.

• Data minimization — collect only what you need.
• Purpose limitation — use data only for stated purposes.
• Storage limitation — delete data when the purpose is fulfilled.
• Privacy-Enhancing Technologies (PETs) include differential privacy, homomorphic encryption, and tokenization.

Architecture Exam Tips #

• DMZ questions: a two-firewall DMZ is always more secure than a single-firewall screened subnet.
• Zero Trust vs. perimeter: the exam often presents a scenario where VPN and perimeter tools are insufficient. ZTNA and microsegmentation are the correct answers.
• Active-active vs. active-passive: choose active-active for performance, active-passive for simplicity.
• RBAC vs. ABAC: when coarse role assignment fails, ABAC provides the fine-grained control.
• OCSP stapling is the performance-friendly revocation check method — it appears on the exam regularly.

Next Steps #

With the architecture designed, move to Security Engineering to implement these controls. Then cover Security Operations to run them. Return to Governance, Risk, and Compliance for the business context that drives architecture decisions, and to the CompTIA SecurityX Course for the full domain overview.