A security architect’s job is a lot like an ER doctor’s triage protocol. You don't just treat the most obvious wound; you follow a strict decision tree to stabilize the entire system based on foundational principles. The Security Architecture domain tests your ability to build that protocol for a network, ensuring resilience is designed in, not just patched on after a breach.
The CompTIA Security+ Security Architecture domain (SY0-701, Domain 3.0) tests your ability to implement and apply secure design principles across enterprise environments. It covers secure network and system design, cloud architecture, and application security, comprising 18% of your total exam score.
Key facts
- Exam Domain
- 3.0 Security Architecture
- Exam Code
- SY0-701
- Domain Weight
- 18% of the exam
- Passing Score
- 750 on a scale of 100-900
- Key Frameworks
- NIST Cybersecurity Framework (CSF), ISO 27001, Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM)
- Official Body
- CompTIA
The U.S. Bureau of Labor Statistics projects that employment for information security analysts will grow 32% from 2022 to 2032, much faster than the average for all occupations (BLS).
What Does Security Architecture (Domain 3.0) Actually Cover?
Security Architecture is where you stop being a security firefighter and start being the fire marshal. It’s the part of the SY0-701 exam that evaluates your ability to design secure, resilient systems from the ground up. CompTIA wants to know if you can analyze a business need and recommend a secure solution, whether that’s segmenting a network, deploying a cloud service, or hardening an industrial control system.With an 18% weighting, this domain carries significant influence on your final score. A weak performance here is a common reason that otherwise knowledgeable candidates fail. This domain tests your ability to connect concepts. If you're struggling with that, try VoraPrep's free CompTIA practice questions to see how our adaptive engine pinpoints and helps you fix those conceptual gaps.
Studying for CompTIA Security+? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
The domain is broad, but it boils down to these core areas:
- Secure Network Design: Placing firewalls, creating DMZs, segmenting with VLANs, and deploying IDS/IPS.
- Secure System & Application Design: Hardening servers, implementing secure boot processes, and understanding secure coding principles.
- Cloud & Virtualization: Applying security principles to IaaS, PaaS, and SaaS, plus securing virtual machines and containers.
- Resilience & Automation: Designing for high availability and using tools like SOAR to automate responses.
- Embedded & Specialized Systems: Securing non-traditional endpoints like IoT devices, medical equipment, and industrial controls (SCADA/ICS).
A Decision-Tree Playbook for Architecture Scenarios
Memorizing definitions is a failing strategy for this domain. You need mental models to deconstruct scenarios. Let's apply a decision-tree approach to two common exam challenges: cloud service selection and network segmentation.Playbook 1: Choosing the Right Cloud Service Model (IaaS vs. PaaS vs. SaaS)
The exam will give you a business requirement. Your first job is to identify who needs to control what.Step 1: Does the business need to manage the Operating System?
Ask yourself: "Does the scenario require custom OS configurations, specific patching schedules, or kernel-level access?"- If YES: The answer is Infrastructure as a Service (IaaS). With IaaS (e.g., an Azure VM), you control the OS and everything above it. Choose this for maximum control.
- If NO: The company is willing to let the provider handle the OS. Proceed to Step 2.
Step 2: Does the business need to manage the application runtime and middleware?
Ask yourself: "Are developers deploying custom code and need to manage the development platform (like Python, .NET Core, or a specific database engine)?"- If YES: The answer is Platform as a Service (PaaS). With PaaS (e.g., AWS Elastic Beanstalk), the provider manages the OS, but your team manages the application and its environment. Choose this for rapid custom development without server management.
- If NO: The company doesn't need to manage the OS or the development platform. Proceed to Step 3.
Step 3: Does the business simply need to use a finished application?
Ask yourself: "Is the goal to provide users with a ready-to-use software product over the web?"- If YES: The answer is Software as a Service (SaaS). With SaaS (e.g., Salesforce), the provider manages everything. You are just a user. Choose this for the lowest management overhead.
Playbook 2: Designing a Secure Network Segment (The DMZ)
A classic PBQ might ask you to place servers correctly in a network diagram.- Identify High-Risk Assets: The WEB-SRV is exposed to the internet, making it high-risk. The DB-SRV contains sensitive data and is low-risk, requiring maximum protection.
- Apply Principle of Least Privilege: The internet should only be able to talk to the WEB-SRV, and only on specific ports (e.g., 443 for HTTPS). The WEB-SRV should be the only machine that can initiate a connection to the DB-SRV. The internal network should never initiate connections into this segmented zone.
- Select the Architectural Pattern: This calls for a Demilitarized Zone (DMZ). The DMZ is an isolated network segment that sits between the untrusted internet and the trusted internal network.
- Place Components and Define Rules:
- External Firewall: Place it between the Internet and the DMZ.
- Rule: Allow inbound traffic from Any IP to WEB-SRV IP on port 443. Deny all other inbound traffic.
- DMZ: Place the WEB-SRV inside the DMZ.
- Internal Firewall: Place it between the DMZ and the Internal Network.
- Rule 1: Allow inbound traffic from WEB-SRV IP to DB-SRV IP on port 1433 (for SQL).
- Rule 2: Deny all other inbound traffic from the DMZ to the Internal Network.
- Rule 3: Deny all outbound traffic from the Internal Network to the DMZ.
This design ensures that even if the WEB-SRV is compromised, the attacker is trapped in the DMZ and cannot directly access the internal network. This is defense-in-depth in action.
Calculate Your CompTIA Security+ Score & Study Hours by Domain
Adjust your practice scores across official CompTIA Security+ blueprint domains to predict your pass probability and generate a domain-weighted study schedule.
Understanding the Full Spectrum of Security Controls
A common failure point is confusing the different ways to classify security controls. The exam will test you on both their function and their implementation.| Control Classification | Purpose | Example Question Clue |
|---|---|---|
| Preventive | Stops an incident from occurring. | "How can we stop unauthorized users from accessing the server room?" (Answer: A lock) |
| Detective | Identifies that an incident has occurred. | "How can we know if an unauthorized user entered the server room?" (Answer: A motion-detecting camera) |
| Corrective | Remediates the impact of an incident. | "What system helps restore data after a ransomware attack?" (Answer: Data backups) |
| Deterrent | Discourages an attacker from trying. | "What can we install to discourage theft of company laptops?" (Answer: A "You are being monitored" sign) |
| Compensating | A backup control used when a primary control is not feasible. | "We can't implement two-factor authentication on a legacy system. What's an alternative?" (Answer: Increased monitoring of that system's logs) |
The exam will often combine these with implementation types (Technical, Administrative, Physical). For instance, a firewall rule is a Technical Preventive control. A mandatory vacation policy is an Administrative Detective control (it helps detect fraud).
How to Study for Security Architecture Effectively
This domain demands active, not passive, learning.- Whiteboard Everything: Don't just read about network topologies. Draw them. Sketch out a DMZ. Diagram the flow of data in a three-tier application. This active recall process builds mental muscle that reading alone cannot.
- Focus on Vendor-Neutral Principles: The exam will not ask you to compare a Cisco firewall to a Palo Alto one. It will ask you about the principles of a stateful firewall or a Web Application Firewall (WAF). Understand the generic technology's function.
- Master Specialized Systems: Don't skip the sections on IoT, SCADA, and embedded systems. These are increasingly important on the SY0-701. Understand their unique constraints: low power, lack of processing capability, and inability to be patched easily.
Spaced repetition is essential for locking in the sheer volume of concepts. VoraPrep's complete course includes an FSRS spaced-repetition flashcard system that automatically schedules concepts for review, ensuring they stick in your long-term memory. You can get more details on our full exam format breakdown.
The Best Way to Prepare for Domain 3.0 in 2026
Many candidates fall into the trap of buying expensive, outdated courses that rely on 100+ hours of passive video lectures. This leads to video fatigue and poor retention, especially for a conceptual domain like Security Architecture.VoraPrep offers a complete, 6-pillar interactive course designed for busy professionals. Our platform is built around active learning:
- Interactive Lessons: Step-by-step lessons with embedded questions ensure you're understanding, not just watching.
- Adaptive Practice: A bank of 1,500+ questions with an engine that automatically focuses on your weak areas.
- 1:1 Exam Simulation: Practice with realistic Pearson VUE simulations, including the drag-and-drop PBQs common in this domain.
- FSRS Flashcards: A memory-scheduled system to lock in key terms and architectural patterns.
- Personalized Study Plan: A dynamic calendar and a calibrated pass-readiness score predictor to keep you on track.
- Vory, Your 24/7 Tutor: Get instant, step-by-step explanations for any concept, anytime.
For a monthly price of $25, you get a more effective and engaging study system than traditional bundles costing thousands. See a full comparison in our guide to the Best CompTIA Security+ Review Courses (2026).