Comptia Sec+ (3.0 Security Architecture)

What is the endpoint in the context of hardening?

The endpoint is where users access applications and data on platforms such as mobile devices and desktops; it must be protected from both inbound and outbound attacks using defense in depth.

What is Endpoint Detection and Response (EDR), and how can it respond to threats?

EDR uses methods such as behavioral analysis, machine learning, process monitoring, and a lightweight endpoint agent instead of relying only on signatures. It can investigate root cause and respond by isolating the system, quarantining the threat, or rolling back to a previous configuration, often through API-driven automation.

What is a host-based firewall?

A software-based personal firewall that runs on an endpoint and controls incoming or outgoing application traffic, including traffic by application process.

What is a Host-based Intrusion Prevention System (HIPS), and what can it detect?

HIPS recognizes and blocks known attacks, helps secure OS and application configurations, and validates incoming service requests using signatures, heuristics, or behavior. Examples include buffer overflows, registry updates, writes to the Windows folder, and access to non-encrypted data.

Why should unnecessary ports and services be closed, and how can administrators verify them?

Every open port is a possible entry point, so only required ports and services should remain available and access should be controlled with a firewall. Nmap or a similar port scanner can verify open ports, with ongoing monitoring.

Why must default passwords and settings be changed?

Network devices and applications often expose management or maintenance interfaces, so leaving defaults in place can provide attackers with access to critical systems or sensitive data.

Why should unnecessary software be removed?

All software can contain bugs and security vulnerabilities; removing unused applications reduces risk and reduces the amount of software that must be patched.

What is a cloud responsibility matrix?

Documentation that identifies who is responsible for specific security tasks in cloud services such as IaaS, PaaS, and SaaS. Responsibilities can vary by provider and by contractual agreement.

What security challenges can a hybrid cloud create?

Using more than one public or private cloud adds complexity such as mismatched authentication, firewall configurations, server settings, diverse cloud-specific logs, and possible data leakage across the public Internet.

Why must third-party cloud vendors be included in security planning?

Organizations depend on cloud providers and other vendors, so vendor risk should be assessed continuously and their impact should be included in incident-response planning and monitoring.

What is Infrastructure as Code (IaC)?

Defining servers, networks, applications, and related infrastructure as code so the environment can be versioned and built repeatedly from a defined description.

What is serverless architecture or Function as a Service (FaaS)?

An architecture where application functions run in short-lived, stateless compute containers managed by a third party, removing most operating-system management from the developer.

What is the role of APIs in a microservices architecture?

APIs connect independent microservices so separate application functions can communicate while remaining scalable, resilient, and more easily contained for security and compliance.

What is physical isolation?

Keeping devices physically separate, such as creating an air gap between networks, so they cannot communicate unless a physical connection is added.

What is the difference between physical segmentation and logical segmentation with VLANs?

Physical segmentation uses separate infrastructure, while VLANs separate systems logically and require a Layer 3 device or router for communication between VLANs.

What are the three functional planes described in Software Defined Networking (SDN), and what does each do?

The data or infrastructure plane processes frames and packets such as forwarding, trunking, encryption, and NAT; the control plane manages actions through routing, session, and NAT tables and routing updates; the application or management plane configures and manages devices through interfaces such as SSH, a browser, or an API.

What is a major difference between cloud-based and on-premises security responsibility?

Cloud environments centralize much of the infrastructure with a third party, while on-premises environments place the security and infrastructure burden directly on the organization.

What advantages and disadvantages are associated with on-premises security?

It provides full control and allows a local team to manage security and availability directly, but staffing can be expensive and security changes may require new equipment, configuration, time, and cost.

Why do organizations centralize security management across decentralized systems, and what is a downside?

Centralization can provide correlated alerts, consolidated log analysis, and comprehensive status, maintenance, and patching across many locations and platforms. It can also create a single point of failure and potential performance issues.

What is virtualization?

Running multiple operating systems on the same physical hardware, with each virtual machine typically having its own guest operating system.

How does application containerization differ from traditional virtualization?

A container packages an application and its dependencies as an isolated process while using the host kernel, making it lighter than giving each application its own guest operating system.

What security issue is commonly associated with Internet of Things (IoT) devices?

IoT devices often have weak default security because manufacturers may focus on device functionality rather than strong security controls.

What is SCADA, and why does it require strong segmentation?

Supervisory Control and Data Acquisition is used for large-scale, multi-site industrial control systems; because it can control critical industrial equipment, the notes recommend extensive segmentation and no outside access.

What is a Real-Time Operating System (RTOS)?

An operating system with a deterministic processing schedule, used where processes cannot wait, such as industrial equipment, automobiles, and military environments.

What is an embedded system?

Hardware and software designed for a specific function or as part of a larger system, such as a traffic-light controller, digital watch, or medical imaging system.

What is high availability (HA)?

A design goal in which services are always on and available; unlike basic redundancy, HA does not require a failed system to be manually brought online.

How do availability, resilience, and MTTR relate to infrastructure design?

Availability is keeping systems up so authorized users can access data and complete transactions. Resilience is the ability to maintain or recover availability after a problem, and MTTR means Mean Time to Repair, a measure associated with recovery speed.

What infrastructure considerations are associated with cost, responsiveness, scalability, and ease of deployment?

Cost includes installation, maintenance, repair, replacement, and operating or capital expenses. Responsiveness is request-to-response speed. Scalability is the ability to adjust capacity as demand changes, and deployment can be simplified through orchestration and automation while security monitoring must scale with the environment.

What is risk transference?

Moving some financial risk to a third party, such as using cybersecurity insurance to help cover attack-related losses, downtime, or legal costs.

Why is ease of recovery an important infrastructure consideration?

Recovery time affects business operations; the notes illustrate that restoring from a standardized corporate image can be much faster than reinstalling from original operating-system media.

Why are patch availability and the inability to patch important infrastructure considerations?

Software needs bug fixes and security updates, so regular vendor patch availability matters. If a system such as an embedded device cannot be patched, additional security controls such as a firewall may be needed to reduce exposure.

What power and compute factors should be considered when designing infrastructure?

Plan primary and backup power such as UPSs and generators, and choose compute resources that balance development simplicity, complexity, and scalability.

How does device placement contribute to secure infrastructure?

Security devices should be positioned where they can protect appropriate zones, such as firewalls between trusted and untrusted networks and technologies such as honeypots, jump servers, load balancers, and sensors where needed.

What are security zones?

Logical areas such as trusted, untrusted, internal, external, Internet, servers, databases, or screened networks that simplify security policies by applying rules between zones.

What is the attack surface, and how can it be minimized?

The attack surface includes all possible ways into a system, such as application code, open ports, authentication processes, and human error. Minimize it by auditing code, blocking unnecessary ports, and monitoring network traffic in real time.

How can network connectivity itself be hardened?

Protect physical cabling and drops and use application-level or network-level encryption such as IPsec tunnels and VPN connections.

What is the difference between fail-open and fail-closed?

Fail-open allows data to continue flowing when a security system fails; fail-closed stops data flow when the system fails.

What is the difference between active and passive security monitoring?

Active monitoring is inline and can block traffic in real time; passive monitoring examines a copy of traffic from a tap or port monitor and cannot block it in real time.

What is the difference between an IDS and an IPS, and what attacks can an IPS address?

An Intrusion Detection System generates an alarm or alert, while an Intrusion Prevention System can stop malicious traffic before it enters the network. IPS can identify exploits such as buffer overflows, cross-site scripting, and other operating-system or application vulnerabilities.

What is a jump server, and why is it a significant security concern?

A jump server is a highly secured and monitored system used to access protected network zones, commonly through SSH, a tunnel, VPN, or RDP. Because it provides a path into protected areas, its compromise can be a significant breach.

What is a proxy server, and what security functions can it provide?

A proxy sits between users and an external network and sends requests on their behalf. It can provide caching, access control, URL filtering, and content scanning, and may be explicit or transparent.

What is load balancing?

Distributing traffic across multiple servers so the workload is shared and a server outage can have little or no effect on users.

What is the difference between active/active and active/passive load balancing?

Active/active uses multiple active servers and can provide functions such as offloading, caching, prioritization, and content switching; active/passive keeps some servers on standby to take over after a failure.

What are sensors and collectors in security monitoring?

Sensors generate security data such as IPS, firewall, authentication, web, database, or email logs, while collectors such as SIEM or syslog systems aggregate and correlate that information.

How do EAP and IEEE 802.1X work together?

EAP is an authentication framework supporting many authentication methods, while 802.1X provides port-based Network Access Control and prevents wired or wireless network access until authentication succeeds.

What are the three major roles in 802.1X authentication, and what services can validate credentials?

The supplicant is the client, the authenticator is the device providing network access, and the authentication server validates credentials. Authentication services can include RADIUS, LDAP, TACACS+, or Kerberos.

What does a network-based firewall do?

It controls network traffic, commonly filtering by port number or application, and may also provide VPN encryption, routing, NAT, and other network functions.

What is Unified Threat Management (UTM)?

An all-in-one security appliance that can combine functions such as URL filtering, content and malware inspection, spam filtering, routing, switching, firewalling, IDS/IPS, bandwidth shaping, and VPN services.

What is a Next-Generation Firewall (NGFW)?

A firewall that analyzes application-layer traffic and can make decisions based on applications, deep packet inspection, application-specific IPS signatures, and content categories.

What is a Web Application Firewall (WAF)?

A firewall focused on HTTP and HTTPS conversations that allows or denies traffic based on expected input and helps protect web applications from attacks such as SQL injection.

What is a VPN, and how is an SSL/TLS VPN commonly used?

A VPN sends encrypted private data across a public network, often through a VPN concentrator. The notes describe SSL/TLS VPNs over TCP port 443 as commonly used for remote user access with relatively few firewall issues.

What is a site-to-site IPsec VPN?

An encrypted tunnel between networks, such as a corporate network and a remote site, using VPN-capable firewalls or concentrators at each side.

How do SD-WAN and SASE differ, and where do VPNs fit?

SD-WAN manages cloud-focused WAN connectivity but does not fully address security. SASE combines network and cloud-based security services using clients for streamlined connections. The notes associate SSL/TLS VPNs with user access and IPsec tunnels with site-to-site access.

What major data types are identified in the notes?

Regulated data, trade secrets, intellectual property, legal information, financial information, human-readable data, non-human-readable data, and hybrid formats such as CSV, XML, and JSON.

Why is sensitive data classified?

Different categories of data require different levels of security and handling, such as additional permissions, different viewing processes, or restricted network access.

What is proprietary data?

Data owned by an organization, often unique to that organization and potentially including trade secrets.

What is Personally Identifiable Information (PII)?

Information that can identify an individual, such as a name, date of birth, mother's maiden name, or biometric information.

What is Protected Health Information (PHI)?

Health-related information associated with an individual, such as health status, healthcare records, or healthcare payment information.

What data classification levels are listed in the notes, and what do they mean?

Sensitive includes information such as intellectual property, PII, and PHI; confidential is very sensitive and requires approval to view; public or unclassified has no viewing restrictions; private/classified/restricted has limited access and may require an NDA; critical data should always be available.

What is data at rest, and how should it be protected?

Data stored on devices such as hard drives, SSDs, or flash drives; protect it with whole-disk, database, file, or folder encryption and appropriate access controls.

What is data in transit?

Data moving across a network, also called data in motion; it can be protected with controls such as firewalls and IPS and with transport encryption such as TLS or IPsec.

What is data in use?

Data actively being processed in memory, CPU registers, or cache; it is usually decrypted while being used and can therefore be attractive to attackers.

What does data sovereignty mean?

Data stored in a country is subject to that country's laws, including possible legal monitoring and court orders.

How can geolocation be used to control data access?

Location can be determined through methods such as 802.11 wireless, mobile providers, or GPS. Organizations can use location to prevent access from other countries or permit enhanced administrative access only from secure areas.

What are geographic restrictions and geofencing?

Geographic restrictions use network or physical location to control access. Geofencing can automatically allow or restrict an application or service based on whether the user is within an approved location.

How does encryption protect data in the 3.3 protecting-data section?

Encryption converts plaintext into unreadable ciphertext and allows conversion back when the proper key is available, making the encrypted data drastically different from the original.

How does hashing protect data?

Hashing creates a one-way message digest or fingerprint. It can be used to store passwords, verify document integrity, and support digital signatures for authentication, non-repudiation, and integrity.

What is obfuscation?

Making normally understandable information difficult to understand, such as transforming readable code into a hard-to-read form while preserving its behavior.

What is data masking?

A form of obfuscation that hides some of the original sensitive data from view while the original data may remain intact in storage.

What is tokenization?

Replacing sensitive data with a non-sensitive placeholder that is not mathematically related to the original data; it is not encryption or hashing.

How does data segmentation help protect sensitive information?

Separating data into different locations prevents one breach from exposing everything and allows the most sensitive information to receive stronger protection.

How do permission restrictions protect data?

They control both the authentication process, such as password and factor policies, and the permissions granted after login to prevent unauthorized access.

What are server clustering and load balancing, and how do they differ?

Server clustering combines two or more servers so they appear and operate as one system, commonly using the same OS. Load balancing distributes requests across multiple servers that may be unaware of each other and may use different operating systems.

What is site resiliency?

Preparing an alternate processing site with synchronized data so business processes can fail over during a disaster and later return to the primary site through a documented process.

What is a hot site?

An almost exact duplicate of the primary environment with hardware, applications, software, and replicated data kept ready for rapid failover.

What is a cold site?

An empty alternate facility with no hardware, data, or personnel already in place; the organization must bring what it needs after a disaster.

What is a warm site?

A recovery site between hot and cold, providing some ready infrastructure or hardware while requiring the organization to bring remaining software, data, or equipment needed to operate.

Why should recovery sites use geographic dispersion?

A disaster can affect a large region, so the alternate site should be physically separated from the primary location, even though this creates logistical challenges.

How does platform diversity improve resiliency?

Using different operating systems, applications, and clients spreads risk because many vulnerabilities affect only a particular platform.

How can a multi-cloud strategy improve resiliency?

Using multiple cloud providers disperses data and services so an outage or breach at one provider does not necessarily affect the others.

What is Continuity of Operations Planning (COOP)?

Planning documented and tested alternatives such as manual transactions, paper receipts, or phone approvals so operations can continue when computer systems are unavailable.

What is capacity planning?

Capacity planning matches supply to demand so too little capacity does not cause slowdowns or outages and too much capacity does not create unnecessary cost.

How can people, technology, and infrastructure be adjusted during capacity planning?

People capacity may require hiring, redeployment, or downsizing. Technology can scale through distributed web services, clustered or split databases, and cloud resources on demand. Infrastructure includes resources such as application servers, network services, CPU, network, and storage.

What is recovery testing?

Testing disaster and recovery procedures before a real event using defined rules of engagement, a specific scenario, a limited time, and documented evaluation.

What is a tabletop exercise?

A discussion-based exercise where key participants talk through a simulated disaster without performing a full-scale operational drill.

What is failover?

Switching from a failed device or service to a redundant operational unit, often automatically, so operations can continue.

How can simulations test security readiness?

Organizations can simulate events such as phishing, password requests, or data breaches to test both technical controls and user behavior.

How does parallel processing improve recovery?

Work is split across multiple processors or systems, allowing a faulty processor or device to be removed while the remaining processors continue operating.

What factors should be considered when planning backups?

The amount of data, backup type, media, storage location, backup and recovery software, frequency, and schedule.

What is the difference between onsite and offsite backups?

Onsite backups are immediately available without an Internet connection and are generally less expensive; offsite backups remain available after a local disaster and can often be restored from anywhere.

Why are backup frequency and encryption important?

Backup frequency determines how much recent data can be recovered, while encryption keeps the concentrated history of backup data unreadable without the recovery key.

What is a snapshot, and why is it useful?

A snapshot captures a system's current configuration and data, with later snapshots recording changes; it is especially useful for virtual machines and cloud systems because recovery can be very fast.

Why must backups be recovery-tested?

Creating a backup is not enough; organizations should simulate restoration, verify the restored applications and data, and perform periodic audits to ensure the backup actually works.

What are replication and journaling?

Replication keeps data synchronized in multiple locations on an ongoing, near-real-time basis; journaling records a pending storage write before it occurs so recovery is easier if power fails during the write.

How do UPS systems and generators provide power resiliency?

A UPS provides short-term protection from blackouts, brownouts, and surges, while a generator provides longer-term backup power; a UPS can bridge the time needed for a generator to start.