FirstTry

Objective 3.1

SY0-701

Compare and contrast security implications of different architecture models

Objective 3.1 sits in Security Architecture, which carries 18% of the Security+ exam. The questions below are original, written from the official objective title above, and each explanation cites the CompTIA page it rests on.

Objective title verbatim from the official objectives. CompTIA exam page ↗

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

3-1Security Architecture

A cloud engineer places a load balancer that receives traffic directly from internet users. Which network component should host this load balancer?

A private subnet that restricts inbound traffic from external networksPrivate subnets lack direct internet routing and are meant for backend systems like databases.
An object storage bucket configured for anonymous public accessObject storage buckets hold data objects, not network routing components like load balancers.
A public subnet that provides direct internet-facing network routingCorrect · your answerCorrect: this is the subnet type designed for internet-facing components.
A signed URL generated for temporary access to a single resourceSigned URLs grant access to stored objects, not a place to run a load balancer.

Correct.

Checked against cheatsheetseries.owasp.org, July 2026

Concept

Public and private subnets segment a cloud network so internet-facing and backend components are isolated from each other.

Why C

Public subnets contain routing that lets components connect directly to the internet, making them the correct home for a load balancer.

Source

Public subnets house components which will have an internet facing presence. The subnet will contain network routing elements to allow components within the subnet to connect directly to the internet. Some use cases include: Public facing resources, like front-end web applications. Initial touch points for applications, like load balancers and routers.

OWASP Secure Cloud Architecture Cheat Sheet, checked July 2026
#cloud#vpc#subnets#architecture-models

Now you: objective 3.1 questions

No account needed. The explanation opens when you answer.

Sample question 1 of 3

3-1Security Architecture

An infrastructure as code team wants every change to their deployment scripts tracked, reviewed, and revertible alongside the application feature it supports. Which practice meets that need?

Sample question 2 of 3

3-1Security Architecture

A security tool scans Terraform templates for misconfigurations and compliance faults without executing them or connecting to any live environment. Which kind of analysis is this?

Sample question 3 of 3

3-1Security Architecture

When a configuration change is needed, a cloud team provisions an entirely new set of infrastructure matching the updated specification and retires the previous set rather than modifying it in place.

That’s 3 of the full Security+ bank.

Keep going free: 10 questions per certification in bank practice, with no account.

Continue practicing

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.

More objectives in Security Architecture