Home / Flashcard library / Careers & certifications / CompTIA Security+ (SY0-801) / Security Architecture

Careers & certifications

CompTIA Security+ (SY0-801) — Security Architecture flashcards

10 of 61 cards free to study here · 4 topics · the whole deck is built into Willys

SY0-801 domain 3 as scenario questions: cloud, on-premises and OT architecture, segmentation, zero trust and secure access design, data states, classes, roles and protection methods, and resilience: sites, redundancy, backups, testing and recovery metrics.

Get the app All CompTIA Security+ (SY0-801) decks

Learn deck · part of CompTIA Security+ (SY0-801) · written against: Exam SY0-801 V8 objectives, Document Version 2.0; SY0-801 launches on 17 November 2026 (as of October 2026). Updated 2026-10-10.

Study the free sample

10 cards from the deck as they are. Flip, rate yourself, filter by topic; your progress stays in this browser.

The 10 sample cards as a list
  1. A team moves an API onto cloud functions that run only when an event fires, with no servers to patch. Which security duties stay with the team?
    Serverless shifts the OS and runtime to the provider, but the team still owns its code, function permissions, secrets and input handling.

    Watch out: one over-permissive role attached to a function hands an attacker everything that role can reach once the function is abused.
    Architecture Models
  2. Several regional hospitals share cloud infrastructure built only for them around their common compliance rules. Which cloud deployment model is this?
    A community cloud.

    It serves organizations with shared concerns such as mission or regulation, and it may be run by members or a third party, on or off their premises.
    Architecture Models
  3. A company's private cloud is hosted and operated by a third party in that party's datacenter. Is it still a private cloud?
    Yes. A private cloud is defined by exclusive use by one organization, not by where it sits or who runs it.

    Watch out: private does not mean on-premises; an outside firm can own or run it, in its own building, as long as only one organization uses it.
    Architecture Models
  4. A public web server must be reachable from the internet without giving attackers a direct path to internal systems. Where should it be placed?
    In a screened subnet (DMZ) between an outer and an inner firewall.

    Why: if the server is compromised, the inner firewall still stands between it and the internal network.
    Infrastructure Security
  5. A plant wants its business network to receive production data without any direct connection between office PCs and the control systems. How are security zones used here?
    Put the two networks in separate security zones with an intermediate DMZ, so every flow terminates there and nothing passes straight from IT to OT.

    Unidirectional gateways can enforce one-way flow where data only needs to leave OT.
    Infrastructure Security
  6. Under zero trust, a user logged in this morning from the office. Why is the user asked to authenticate again before opening the payroll system?
    Zero trust grants access per session: being on the corporate network, or having reached another resource earlier, earns no trust.

    Each request is authenticated and authorized against current policy.
    Infrastructure Security
  7. Why is unstructured data harder to protect than structured data?
    Unstructured data has no fixed fields to point controls at.

    Structured data sits in defined columns, so sensitive values are easy to locate. Documents, email and images can hide sensitive content anywhere, so discovery and DLP need content inspection.
    Data Protection
  8. A database file is encrypted on disk, but an attacker dumps the server's memory during a query and reads plaintext. Which data state was left unprotected?
    Data in use.

    Encryption at rest covers the stored file and encryption in transit covers the wire, but data being processed sits decrypted in memory and needs other protections, such as hardware-isolated enclaves.
    Data Protection
  9. A fully equipped duplicate datacenter with current data can take over within minutes. Which site type is this, and how do the other two compare?
    A hot site.

    A warm site has some or all of the hardware but needs data and setup before it can run; a cold site offers space, power and cooling only, so recovery takes the longest.
    Resilience & Recovery
  10. An insurer's alternate site is 15 km from headquarters, on the same coastal floodplain. What environmental site consideration does this ignore?
    Geographic separation: the alternate site should not be exposed to the same hazard, such as flood, storm or regional power loss, as the primary.

    It still needs to be reachable for the staff and equipment that must move there.
    Resilience & Recovery

Unlock the whole deck

You are studying a free 10-card sample. All 61 cards of CompTIA Security+ (SY0-801) — Security Architecture, the other 7 CompTIA Security+ (SY0-801) decks, and spaced-repetition scheduling are built into Willys. 14-day free trial, then $14.99 a year.

Get the app

In Willys, tap Exam Library at the top of your Decks (or Browse Exam Library… under the + button), find the exam on its shelf or by search, tick it and tap Add.

More CompTIA Security+ (SY0-801) decks

General Security ConceptsThreats, Vulnerabilities & AttacksControls & MonitoringIdentity, Automation & ResponseProgram Management & OversightCloze: AcronymsPractice Questions

← All CompTIA Security+ (SY0-801) decks, with the study guide and topic outline.

About these cards

Review status: Author-checked against the sources below and machine-validated; no independent second-reader pass yet.

Checked against:

  • Checked against the CompTIA Security+ SY0-801 V8 exam objectives, Document Version 2.0 (topic list only; no text copied).
  • Checked against NIST SP 800-145 (cloud deployment and service models), NIST SP 800-207 (zero trust tenets) and NIST SP 800-82 Rev. 3 (OT security) (public domain; reference only; no text copied).
  • Checked against NIST SP 800-204 and SP 800-204C (microservices, infrastructure as code) and NIST SP 800-215 (SASE) (public domain; reference only; no text copied).
  • Checked against NIST SP 800-34 Rev. 1 (contingency planning), NIST SP 800-88 Rev. 2 (media sanitization), NIST SP 800-188 (de-identification) and the NIST CSRC Glossary (public domain; reference only; no text copied).
  • Checked against IETF RFC 4301 (IPsec), Regulation (EU) 2016/679 (GDPR roles), Executive Order 13526 (classification levels), the FTC's COPPA FAQ and the CISA #StopRansomware Guide (reference only; no text copied).
  • Checked against Microsoft Learn documentation on group Managed Service Accounts and Global Secure Access (reference only; no text copied).

These are independent study notes written for Willys. They are not official exam material, may contain mistakes, and are no substitute for your course, your teacher or the exam owner's own publications. Found an error? Tell us — corrections ship as a new version of the deck.

CompTIA® and Security+® are registered trademarks of CompTIA, Inc. This product is not affiliated with or endorsed by CompTIA.

Use of these pages is covered by our Terms of Use.