Security Architecture is worth 18% of CompTIA Security+ SY0-701. This set covers how networks and systems are built securely: where to place security devices, what happens when they fail, how to control who plugs into the network, which firewall and VPN features to choose, and how to handle special systems such as industrial controls and IoT devices.
This is the fifth set in our Security+ SY0-701 series (Questions 41-50). It follows SY0-701 Questions 31-40 on general security concepts and cryptography. Cloud architecture was covered in Questions 1-10. Every question is an original practice scenario mapped to the official exam objectives, not a copy of a real exam item.
Infrastructure questions often hinge on one word in the scenario, such as “block”, “monitor”, or “must keep working”, so read carefully before you answer.
Question 41: When the Firewall Itself Fails
A firewall protects a network segment that holds cardholder data. The security policy states that if the firewall fails, no traffic may reach the segment, even if that causes an outage. Which failure mode should the firewall use?
A) Fail-open
B) Fail-over to a bypass cable
C) Fail-closed
D) Passive mode
👁 Reveal Answer
Correct Answer: C
Explanation: A fail-closed device blocks all traffic when it fails, which protects confidentiality and integrity at the cost of availability. That matches a policy that puts protection of cardholder data first. A lets traffic flow uninspected when the device fails, keeping services up but removing protection. B is effectively fail-open. D describes a monitoring-only device, which never blocks traffic in the first place.
Reference: CompTIA Security+ SY0-701 exam objectives, 3.2 (failure modes: fail-open, fail-closed)
Question 42: Detect or Block?
A company already has a sensor that copies network traffic from a switch port and alerts on attacks. Management now wants malicious traffic to be stopped automatically before it reaches the servers. What should be deployed, and where?
A) An intrusion prevention system (IPS) placed inline, so traffic must pass through it
B) A second intrusion detection system (IDS) on another mirrored port
C) A network tap connected to the IDS
D) A SIEM dashboard for the operations team
👁 Reveal Answer
Correct Answer: A
Explanation: An IDS connected through a tap or port mirror sees copies of traffic and can only alert, which is a passive, monitoring placement. To stop attacks, the device must be active and inline, so that traffic flows through it and it can drop malicious packets. That is an IPS. B and C add more monitoring but still cannot block. D improves visibility for people, but nothing is blocked automatically.
Reference: CompTIA Security+ SY0-701 exam objectives, 3.2 (device attributes: active vs passive, inline vs tap/monitor)
Question 43: One Controlled Door Into a Secure Network
Administrators must manage servers in a highly restricted network segment. The company wants all administrative access to go through a single hardened, monitored system instead of allowing administrators’ laptops to connect to the servers directly. What should it deploy?
A) A load balancer
B) A forward proxy for web browsing
C) A wireless access point inside the segment
D) A jump server
👁 Reveal Answer
Correct Answer: D
Explanation: A jump server (also called a jump box) is a hardened system that administrators connect to first and then use to reach systems in a protected zone. It limits the attack surface to one well-monitored entry point and makes it easier to log and control administrative sessions. A distributes client traffic across servers. B controls outbound web access. C would create a new, uncontrolled way into the restricted segment.
Reference: CompTIA Security+ SY0-701 exam objectives, 3.2 (network appliances: jump server)
Question 44: Network Ports in the Lobby
A visitor plugged a personal laptop into a network jack in a conference room and received full access to the internal network. The company wants every wired and wireless device to authenticate before it gets network access, using a central authentication server. What should it implement?
A) MAC address filtering on the access points only
B) Port-based network access control with 802.1X, using EAP and a RADIUS server
C) A stronger Wi-Fi password
D) A honeypot in the conference room
👁 Reveal Answer
Correct Answer: B
Explanation: IEEE 802.1X provides port-based network access control. The switch or access point (authenticator) blocks a port until the device (supplicant) authenticates through the Extensible Authentication Protocol (EAP) against a central server, typically RADIUS. Unauthenticated devices get no access or are placed in a restricted network. A is easy to bypass by spoofing a MAC address and does not cover wired ports. C applies only to Wi-Fi and is a shared secret. D detects attackers but does not stop them from connecting.
Reference: CompTIA Security+ SY0-701 exam objectives, 3.2 (port security: 802.1X, EAP)
Question 45: Blocking an App That Uses Port 443
A company wants to block a specific file-sharing application while still allowing all other HTTPS traffic. The application uses port 443 like normal web traffic. A traditional firewall that filters only by IP address and port cannot tell the difference. What is needed?
A) A Layer 4 firewall rule that blocks port 443
B) A network address translation (NAT) rule
C) A static route to a null interface
D) A next-generation firewall (NGFW) that identifies applications at Layer 7
👁 Reveal Answer
Correct Answer: D
Explanation: A Layer 4 firewall makes decisions using IP addresses, ports, and protocols. A next-generation firewall works at Layer 7 and can identify applications regardless of the port they use, so it can block one application while allowing the rest of HTTPS. A would block all secure web browsing. B translates addresses and is not an application filter. C drops all traffic to a destination, which does not help when the application’s servers change or share addresses with other services.
Reference: CompTIA Security+ SY0-701 exam objectives, 3.2 (firewall types: Layer 4, Layer 7, NGFW, UTM, WAF)
Question 46: Protecting a Water Treatment Plant
A water utility runs industrial control systems (ICS/SCADA) that control pumps and chemical dosing. The systems are old, cannot be patched easily, and must never be reachable from the internet or the office network. What is the strongest architectural approach?
A) Install antivirus on the controllers and connect them to the office network
B) Expose the control interface through a web portal protected by a password
C) Physically isolate the control network with an air gap, with tightly controlled data transfer when needed
D) Move the controllers to a public cloud
👁 Reveal Answer
Correct Answer: C
Explanation: Industrial control systems often run legacy software that cannot be patched quickly, and their failure can affect physical safety. An air gap physically separates the control network from other networks, so attacks from the internet or the office network cannot reach it directly. Where some connectivity is unavoidable, strict segmentation with tightly controlled, one-way or inspected transfers is used. A connects vulnerable systems to a busier, riskier network. B exposes them to the internet. D is not appropriate for systems that physically control a plant.
Reference: CompTIA Security+ SY0-701 exam objectives, 3.1 (architecture models: ICS/SCADA, air-gapped networks)
Question 47: Connecting Two Offices Securely
A company wants to connect its head office and a branch office over the internet. All traffic between the two sites must be encrypted, including the original IP headers, so that internal addressing is hidden. Which configuration fits?
A) A site-to-site IPsec VPN in tunnel mode
B) IPsec in transport mode between two laptops
C) HTTP with basic authentication
D) A Telnet session between the routers
👁 Reveal Answer
Correct Answer: A
Explanation: In IPsec tunnel mode, the entire original packet, including its IP header, is encrypted and placed inside a new packet with a new header, which is why tunnel mode is used for site-to-site VPNs between gateways. Transport mode (B) protects only the payload and keeps the original header, and is typically used between two hosts. C and D send data, and in Telnet’s case credentials, in clear text.
Reference: CompTIA Security+ SY0-701 exam objectives, 3.2 (secure communication: VPN, tunneling, IPsec)
Question 48: Why Define Infrastructure as Code?
A cloud team currently configures servers and firewall rules by hand, and over time each environment has drifted from the approved design. It is considering infrastructure as code (IaC). What is the main security benefit?
A) IaC removes the need for any access control
B) Configurations are defined in version-controlled templates that can be reviewed, tested, and deployed the same way every time, reducing misconfiguration and drift
C) IaC encrypts all data at rest automatically
D) IaC replaces the need for vulnerability scanning
👁 Reveal Answer
Correct Answer: B
Explanation: With infrastructure as code, environments are built from templates stored in version control. Changes are reviewed and tested like application code, every deployment is consistent, and drift from the approved baseline can be detected and corrected. A is wrong because the pipelines and templates themselves must be protected. C and D overstate what IaC does; encryption and scanning still have to be configured and performed.
Reference: CompTIA Security+ SY0-701 exam objectives, 3.1 (architecture models: infrastructure as code)
Question 49: Smart Devices That Cannot Be Updated
A hotel installs hundreds of smart thermostats and TVs. The devices have limited security features, ship with default credentials, and receive firmware updates rarely. How should they be connected?
A) On the same network as the front desk and payment systems, for easier management
B) With their default credentials, so technicians can log in easily
C) On a separate, segmented network with restricted access to other systems, after changing default credentials
D) With direct inbound access from the internet for the manufacturer
👁 Reveal Answer
Correct Answer: C
Explanation: IoT and embedded devices often have weak security, limited patching, and default credentials. Placing them on their own network segment (for example, a separate VLAN with firewall rules) limits what an attacker can reach if a device is compromised, and changing default credentials closes one of the most common entry points. A lets a compromised thermostat reach payment systems. B and D leave obvious ways in.
Reference: CompTIA Security+ SY0-701 exam objectives, 3.1 (IoT and embedded systems) and 2.2 (default credentials)
Question 50: Filtering and Logging Outbound Web Traffic
A school wants all student web browsing to pass through one system that blocks inappropriate sites, logs requests, and caches popular content to save bandwidth. Which network appliance fits best?
A) A forward proxy server
B) A reverse proxy in front of the school’s own website
C) A load balancer for the web servers
D) A RADIUS server
👁 Reveal Answer
Correct Answer: A
Explanation: A forward proxy sits between internal users and the internet. Clients send their web requests to the proxy, which can filter content, log activity, and cache frequently requested pages. B sits in front of servers to protect and distribute inbound requests to them, not to control outbound browsing. C spreads incoming traffic across servers. D authenticates users and devices but does not inspect web traffic.
Reference: CompTIA Security+ SY0-701 exam objectives, 3.2 (network appliances: proxy server)
Study Tips for Security Architecture
- Placement decides capability. Inline devices can block, while tap and monitor devices can only alert.
- Fail-open favors availability, fail-closed favors security. Read which one the scenario values.
- Control the edges. 802.1X for who connects, jump servers for admin access, and proxies for outbound web.
- Firewall layers. Layer 4 sees ports. Layer 7 and NGFWs see applications. A WAF protects web apps.
- Special systems need isolation. ICS/SCADA and IoT belong on segmented or air-gapped networks.
Keep Practicing for Security+
Go back to SY0-701 Questions 31-40 for core concepts, then continue to Questions 51-60 on data protection and resilience.