Secure architecture is the discipline of designing systems so that a single failure never becomes a full breach. With most organisations now running in the cloud, Security+ blends classic network design with cloud fundamentals. The organising idea is defence in depth — explore its layers in the interactive diagram below.
Beginner: secure design principles
- Defence in depth — multiple independent layers of control; no single control is trusted to stop everything.
- Least privilege — give every user and process only the access it needs.
- Fail secure — when something breaks, it should fail into a safe (denied) state.
- Separation of duties — no single person can complete a sensitive action alone.
- Reduce the attack surface — remove unnecessary services, ports and accounts.
Interactive explainer: defence in depth
Security is layered like an onion. If an attacker gets past one layer, the next should slow or stop them. Explore each layer from the human perimeter down to the data at the core:
Defence in Depth
Layered controls so a single failure never becomes a breach.
Tap or hover a part to learn more.
The human layer.
Security policies, acceptable-use rules and user-awareness training. Most breaches start with a person, so this outer layer is critical.
Check your understanding
1. Why is defence in depth more effective than a single strong control?
2. User-awareness training belongs to which layer?
Intermediate: network design
- Segmentation & VLANs — divide the network so a breach in one zone cannot reach others.
- DMZ — a buffer zone that isolates internet-facing services from the internal network.
- Firewalls, IDS/IPS, proxies — control and inspect traffic between zones.
- Zero trust — never trust based on network location; authenticate and authorise every request.
Advanced: cloud security
The shared responsibility model is the most important cloud concept in Security+: the provider secures the underlying infrastructure, but you remain responsible for your data, identities and configuration. Misconfiguration — public storage buckets, over-permissive IAM roles, open security groups — is the leading cause of cloud breaches. Understand the service models (IaaS / PaaS / SaaS), security groups and network ACLs, encryption options, and cloud-native logging and monitoring.
Practical example
A web application is deployed with the database in a private subnet, the web tier in a DMZ, security groups allowing only required ports, MFA on the cloud console, and encryption enabled on storage. A compromised web server cannot reach the database directly or move laterally across the network — defence in depth in action.
Common mistakes
- A flat network with no segmentation, letting one compromise spread everywhere.
- Leaving cloud storage public or IAM roles far too broad.
- Assuming the cloud provider secures your data and configuration.
- Trusting all internal traffic implicitly (the opposite of zero trust).
Best practices
Segment networks, adopt zero-trust principles, encrypt data in transit and at rest, harden and patch systems, apply secure baselines (CIS Benchmarks), and continuously audit cloud configuration.
What employers expect
You can sketch a segmented, defensible architecture, explain the cloud shared responsibility model without hesitation, and describe how zero trust differs from a traditional perimeter.
Technical interview questions
- What is defence in depth, and can you give a control at three different layers?
- Explain the cloud shared responsibility model.
- What is zero trust and how does it differ from a perimeter model?
- How does network segmentation limit the blast radius of a breach?
- What are the most common cloud misconfigurations and how do you prevent them?
Behavioural interview questions
- Describe a time you improved how a system was designed or secured.
- Tell me about a time you pushed back on an insecure design decision.
Practice questions
- Which zone isolates internet-facing servers? (DMZ)
- In IaaS, who is responsible for securing the customer's data and IAM? (The customer)
- Which model assumes no implicit trust based on network location? (Zero trust)
Where this fits in your Security+ pathway
This domain is one part of the CompTIA Security+ study hub. When you're confident here, review Identity & Access Management and move on to Security Operations to keep building toward the full exam.
Practise with Missiora
- AI Interview™ — rehearse Security+ style questions on this topic and get scored feedback.
- Career Coach™ — turn this knowledge into a study-to-job plan.
- Job Intelligence™ — see which of these skills real security adverts demand.