A company needs a new data loss prevention (DLP) solution. Do you recommend the perimeter-based appliance with 99% detection, or the endpoint agent with 95% detection that covers the entire remote workforce? The exam doesn't want the "strongest" tool; it wants the most appropriate one. Picking the appliance because of its higher detection rate is a classic trap and an instant fail on a performance-based question that specifies a decentralized environment.
This 2026 cheat sheet for CompTIA Security+ Security Architecture (SY0-701 Domain 3) covers essential exam-day concepts. It provides key risk formulas (ALE, SLE), control type distinctions (preventative vs. detective), cryptography essentials, and common traps to help you apply security principles correctly under pressure and avoid costly mistakes.
Key facts
- Exam Code
- SY0-701 (current version for 2026)
- Domain 3 Weight
- 18% of the total exam questions
- Passing Score
- 750 on a 100-900 scale
- Official Body
- CompTIA
- Study Hours
- CompTIA suggests 60-90 hours of dedicated study (CompTIA).
- Question Types
- Multiple-choice questions (MCQs) and performance-based questions (PBQs)
What Does Security Architecture Actually Cover?
The Security Architecture domain (Domain 3) of the SY0-701 exam tests your ability to design and implement secure solutions. It requires you to move past memorization and apply security principles to real-world business and technical problems. You must understand why one control is chosen over another in a given context.
High-priority topics in this domain include:
- Secure Network Design: Concepts like network segmentation, zero trust, firewalls, and VPNs.
- Cloud and Virtualization: Shared responsibility models, cloud deployment types (IaaS, PaaS, SaaS), and securing virtual machines and containers.
- Cryptography: The practical application of symmetric vs. asymmetric encryption, hashing functions, and Public Key Infrastructure (PKI).
- Data Security: Protecting data at rest, in transit, and in use through methods like encryption, masking, and tokenization.
- Embedded and Specialized Systems: Securing Internet of Things (IoT) devices, industrial control systems (ICS), and System-on-a-Chip (SoC).
Success in this domain comes from developing the judgment to weigh trade-offs. To build this skill, it's critical to work through scenario-based questions. Try VoraPrep's free CompTIA practice questions to see how these concepts are tested.
Studying for CompTIA Security+? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
Which Formulas, Controls, and Frameworks Are Tested?
This domain contains some of the most testable, rule-based content on the exam. You need a firm grasp of quantitative risk management, the different ways to classify controls, and the purpose of major industry frameworks.
Risk Calculation: ARO, SLE, and ALE
You must be able to calculate the financial impact of a risk to justify spending on a security control.
- Single Loss Expectancy (SLE): The monetary loss from a single incident.
- 🧮 Formula: SLE = Asset Value (AV) × Exposure Factor (EF)
- Annualized Rate of Occurrence (ARO): How many times per year the incident is expected to happen.
- Example: An event that occurs once every four years has an ARO of 0.25 (1 ÷ 4).
- Annualized Loss Expectancy (ALE): The total expected monetary loss for one year.
- 🧮 Formula: ALE = SLE × ARO
Step 1: Calculate SLE
SLE = Asset Value × Exposure Factor SLE = $500,000 × 0.20 = $100,000Step 2: Determine ARO
ARO = 1 attack / 2 years = 0.5Step 3: Calculate ALE
ALE = SLE × ARO ALE = $100,000 × 0.5 = $50,000The company can expect an average annual loss of $50,000 from this threat. This figure justifies spending up to $50,000 per year on a DDoS mitigation service.
Security Control Types: The 2 Key Classifications
The exam will test your ability to classify controls in two primary ways: by their implementation and by their function.
1. Classification by Implementation:- Technical: Controls implemented through technology (e.g., firewalls, encryption, access control lists).
- Administrative: Controls based on policies, procedures, or standards (e.g., security awareness training, incident response plans, background checks).
- Physical: Controls you can physically touch (e.g., fences, locks, security guards, fire suppression systems).
| Control Type | Purpose | Timing in Event Lifecycle | Example |
|---|---|---|---|
| Preventative | Stop incidents before they occur | Before | Firewall, IPS, access control lists, encryption, security guard |
| Detective | Identify incidents as they occur or after | During/After | IDS, log monitoring, security audits, motion detector, CCTV |
| Corrective | Restore systems to normal after an incident | After | Backups and recovery, incident response plan, antivirus quarantine |
| Deterrent | Discourage potential attackers | Before | Warning signs, visible security cameras, threat of legal action |
| Compensating | Alternative control when a primary is not feasible | Before/During/After | Separation of duties when an automated system isn't available |
Key Security Frameworks (And What to Memorize)
You don't need to be an expert on every framework, but you must know their primary purpose.
- NIST Cybersecurity Framework (CSF): A set of voluntary guidelines for organizations to manage cybersecurity risk. Memorize its five core functions: Identify, Protect, Detect, Respond, Recover. It is a high-level framework, distinct from the more detailed technical guidelines in the NIST SP 800 series.
- ISO/IEC 27001: An international standard that specifies the requirements for an Information Security Management System (ISMS). It's formal and often tied to certification.
- MITRE ATT&CK: A knowledge base of adversary tactics and techniques based on real-world observations. It's used for threat modeling and improving detection capabilities.
Calculate Your CompTIA Security+ Score & Study Hours by Domain
Adjust your practice scores across official CompTIA Security+ blueprint domains to predict your pass probability and generate a domain-weighted study schedule.
What Are the Most Common Security Architecture Traps?
The Security Architecture questions are designed to catch candidates who rely on pure memorization.
The most frequent trap is choosing the "best" technical solution instead of the "most appropriate" one. A question might describe a small non-profit with a tiny budget. While a next-generation firewall with advanced threat intelligence might seem like a great answer, the correct choice is likely a properly configured open-source firewall that meets the organization's specific needs and budget. Always read the scenario for constraints.
Another common pitfall is misinterpreting the ARO in risk calculations. If an event happens "once every five years," the ARO is 1 ÷ 5 = 0.2. Many candidates mistakenly use 5, leading to a wildly incorrect ALE.
Finally, watch out for questions that test the order of operations. For example, when implementing PKI, you must generate a key pair before you can create a Certificate Signing Request (CSR). Questions will present the steps in the wrong order to see if you know the correct process.
How Can I Memorize Key Architecture Concepts?
Use mnemonics for lists and processes that require rote memorization.
For the five NIST CSF functions, remember: I Prefer Detecting Ransomware Rapidly.
- Identify
- Protect
- Detect
- Respond
- Recover
For the three states of data, think about a traffic light:
- Data in Transit (Green): Moving across the network. Protect with TLS/IPsec.
- Data in Use (Yellow): Active in memory (RAM). Generally unprotected, but some technologies exist.
- Data at Rest (Red): Stored on a disk or drive. Protect with disk encryption (e.g., AES-256).
Commit common port numbers to memory (e.g., SSH 22, DNS 53, HTTPS 443, RDP 3389). These are easy points you can't afford to miss. VoraPrep’s FSRS spaced-repetition flashcards are built to drill these facts until they become second nature.
How Should I Use This Cheat Sheet to Study?
This cheat sheet is a review tool, not a primary learning resource. Integrate it into your study plan for maximum effect.
- During Your Final Two Weeks: Start each study session with a 5-minute review of this sheet. Verbally explain the ALE formula, the difference between an IDS and IPS, and the five NIST CSF functions. This active recall will cement the information.
- After a Practice Test: When you review your results, pull up this sheet. If you missed a question on control types, re-read the table and the exam trap callout. If you failed a risk calculation, re-work the example here with the correct numbers. This connects the concepts directly to how they are tested.
- For Targeted Drills: Use the topics listed here to focus your practice. Spend one session just on cryptography questions, another on cloud security scenarios. A complete course like VoraPrep allows you to build custom quizzes based on specific blueprint objectives, targeting your weak areas identified from this sheet.