3.1 Compare and contrast security implications of different architecture models

Domain 3: Security Architecture

Architecture models cover cloud (responsibility matrix, hybrid considerations, third-party vendors), infrastructure as code, serverless, microservices, network infrastructure choices (physical isolation, air-gapped, logical segmentation, SDN), on-premises, centralized versus decentralized, containerization, virtualization, IoT, ICS/SCADA, real-time operating systems, embedded systems, and high availability. Each model then gets weighed against considerations: availability, resilience, cost, responsiveness, scalability, ease of deployment, risk transference, ease of recovery, patch availability, inability to patch, power, and compute. The exam emphasizes trade-off reasoning: an air-gapped ICS network maximizes isolation but complicates patching; serverless shifts responsibility to the provider; IoT and embedded devices often cannot be patched at all. Know the cloud shared responsibility matrix cold — who secures what in IaaS versus SaaS is a recurring question. Candidates struggle most with the specialized systems (SCADA, RTOS, embedded) because the correct answer is usually about their constraints, not their features.

What you must know

common pitfall · Candidates forget the shared responsibility matrix shifts by service model and assign the cloud provider duties the customer keeps in IaaS, like guest OS patching.

Try a sample question

A development team moves an application from virtual machines in an IaaS environment to a serverless platform operated by the same cloud provider. Which security responsibility shifts from the company to the provider as a result of this change?

  • A Writing secure application code and validating user input
  • B Patching the operating system and language runtime environment
  • C Configuring identity and access permissions for each function
  • D Classifying and labeling the data the application processes
Show answer & explanations
  • A Secure coding and input validation remain the customer's responsibility in every cloud service model, because the provider never writes or reviews the customer's application logic.
  • B correct ·Correct. In a serverless model the provider manages the underlying servers, operating system, and language runtime, so patching those layers moves from the customer to the provider.
  • C Identity and access management configuration stays with the customer; the provider supplies the IAM tooling, but the customer must still define least-privilege permissions for each function.
  • D Data classification is always the data owner's duty regardless of service model, since only the customer knows the sensitivity and regulatory context of its own information.

sample item — the full bank runs 450+ questions at exam difficulty

Is objective 3.1 your weak spot?

The free readiness check finds your weakest objectives in 15 adaptive questions — then full access drills them until the gauge clears the cut line.

Check my readiness — free