Security+ topic 3.1
Architecture Models
Where a system runs changes how it is secured. In the cloud, the shared responsibility model splits duties: the provider secures the physical data center, and the customer secures more as they move from SaaS to PaaS to IaaS. Infrastructure as code (IaC) builds systems from templates so they are consistent. Serverless and microservices break apps into small pieces, and containers package apps with what they need. Networks can be on-premises, hybrid, or air-gapped. Operational technology, such as industrial control systems (ICS/SCADA), IoT, and embedded or real-time systems, is hard to patch, so it is often isolated.
Architecture Models vocabulary
- Shared responsibility model: How security duties are split between a cloud provider and its customer.
- Infrastructure as code (IaC): Building and configuring systems from code templates instead of by hand.
- Air-gapped: Physically separated from other networks, including the internet.
- Operational technology (OT): Systems that monitor and control physical equipment, such as industrial control systems.
Exam-style practice questions
Try each one, then open the answer. To save your progress, take this quiz in the interactive course.
1. A company moves from running its own servers to using a SaaS email product. Under the shared responsibility model, which of the following is still the customer's responsibility?
- (A) Patching the provider's mail servers
- (B) Managing user accounts and access
- (C) Securing the provider's data center
- (D) Replacing failed hard drives
Show answer
(B) Managing user accounts and access In SaaS the provider runs the platform, but the customer still manages its users and data.
2. A team builds identical cloud environments from the same template files every time. Which of the following is this?
- (A) Infrastructure as code
- (B) Shadow IT
- (C) Air gapping
- (D) Serverless computing
Show answer
(A) Infrastructure as code Building systems from code templates is infrastructure as code.
3. A water treatment plant's control systems cannot be patched often. Which of the following is the best way to protect them?
- (A) Connect them directly to the internet
- (B) Isolate them on a segmented or air-gapped network
- (C) Install games on them
- (D) Give all employees admin access
Show answer
(B) Isolate them on a segmented or air-gapped network Hard-to-patch ICS/SCADA systems are protected by isolating them.
4. Which of the following best describes a container?
- (A) A physical server rack
- (B) A package that holds an application and everything it needs to run
- (C) A type of firewall
- (D) A backup site
Show answer
(B) A package that holds an application and everything it needs to run Containers package an app with its dependencies so it runs the same anywhere.