3.1 - Security architecture and network devices
Security+ SY0-701 objective 3.1 covers architecture models and the devices that enforce them. A jump server (bastion host) is one hardened, logged host through which admins reach internal servers, shrinking the attack surface. A forward proxy sends internal users' outbound web requests through a device that caches and filters them. A next-generation firewall (NGFW) differs from a traditional stateful firewall mainly because it can inspect and control traffic by application, not just port and protocol. A unified threat management (UTM) appliance combines firewall, IPS, antivirus, web filtering and VPN in one box. You should also weigh on-premises versus cloud, virtualisation, containers, serverless, IoT and SCADA considerations. Expect scenario questions that describe an access or filtering requirement and ask which architecture component - jump server, proxy, NGFW or UTM - best meets it.
One hardened logged host to reach servers = jump server. Filter outbound user web = forward proxy. Control by application (not just port) = NGFW. All-in-one firewall/IPS/AV/VPN = UTM.
Practice questions
1. In IaaS cloud, who is responsible for securing the guest OS and applications?
- The cloud provider
- The customer (correct answer)
- No one
- The internet provider
Under the shared responsibility model, IaaS providers secure the hardware/hypervisor; the customer secures the OS, apps and data. SaaS shifts more to the provider.
2. A next-generation firewall differs from a traditional stateful firewall MAINLY because it can:
- Assign IP addresses to hosts
- Inspect and control by application (correct answer)
- Cache web pages for clients
- Balance traffic across servers
An NGFW adds deep packet inspection, application awareness and often IPS/identity — controlling by app/user, not just ports/IPs. A stateful firewall tracks connections but is port/IP-based.
3. An IDS is deployed to observe a copy of traffic and alert without sitting in the traffic path. This deployment is:
- Inline (in-band) in the path
- Passive (out-of-band via SPAN/TAP) (correct answer)
- Acting as the default gateway
- Chained through a forward proxy
A passive/out-of-band IDS receives mirrored traffic via a SPAN port or network TAP, so it can detect/alert without affecting flow. An inline IPS sits in the path and can block.
4. Which resilience option keeps a fully equipped, near-real-time-replicated site ready for near-instant failover?
- A cold site
- A hot site (correct answer)
- A warm site
- A mobile site
A hot site is fully operational with current data for near-instant failover (highest cost). Warm=partial/some delay; cold=space/power only, longest to bring up.
5. Distributing incoming traffic across multiple servers to improve availability and performance is done by a:
- A jump server
- A load balancer (correct answer)
- A proxy server
- A VPN concentrator
A load balancer spreads requests across a server pool, improving availability and scaling. Clustering has nodes act as one system for failover.
6. Defining and provisioning infrastructure through version-controlled code and templates is called:
- Serverless computing
- Infrastructure as Code (correct answer)
- Software-defined WAN
- Virtual desktop infrastructure
IaC provisions infrastructure from declarative, version-controlled templates — consistent, repeatable and auditable. Misconfigured templates can propagate flaws widely.