Objective 3.1SY0-701

3.1 Compare and contrast security implications of different architecture models

Objective 3.1 sits in Security Architecture, which carries 18% of the Security+ exam. The questions below are original, written from the official objective title above, and each explanation cites the CompTIA page it rests on.

Objective title verbatim from the official objectives. CompTIA exam page

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

Security ArchitectureEasy

A cloud engineer places a load balancer that receives traffic directly from internet users. Which network component should host this load balancer?

Correct.

The concept

Public and private subnets segment a cloud network so internet-facing and backend components are isolated from each other.

Why this answer

Public subnets contain routing that lets components connect directly to the internet, making them the correct home for a load balancer.

  • APrivate subnets lack direct internet routing and are meant for backend systems like databases.
  • Correct: this is the subnet type designed for internet-facing components.
  • CObject storage buckets hold data objects, not network routing components like load balancers.
  • DSigned URLs grant access to stored objects, not a place to run a load balancer.
Read the sourceOWASP Secure Cloud Architecture Cheat Sheet
Verified against cheatsheetseries.owasp.org · 2026-07-27
cloudvpcsubnetsarchitecture-models

Now you: objective 3.1 questions

No account needed. The explanation opens when you answer.

Sample question 1 of 3

Security ArchitectureEasy

An infrastructure as code team wants every change to their deployment scripts tracked, reviewed, and revertible alongside the application feature it supports.

Sample question 2 of 3

Security ArchitectureHard

A security tool scans Terraform templates for misconfigurations and compliance faults without executing them or connecting to any live environment.

Sample question 3 of 3

Security ArchitectureModerate

When a configuration change is needed, a cloud team provisions an entirely new set of infrastructure matching the updated specification and retires the previous set rather than modifying it in place.

That’s 3 of the full Security+ bank.

Keep going free: 10 questions per certification in bank practice, with no account.

Continue practicing

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.

More objectives in Security Architecture