CompTIA Security+ Domain 3: Security Architecture

The policy decision point, paired with an enforcement point, evaluates identity, device, and context for every individual request, which is the defining mechanism of zero trust.

• ATrusting hosts merely because they sit inside an IP range is the implicit-trust assumption zero trust explicitly removes, so it cannot enforce per-request decisions.
• CA one-time session token grants standing access without re-evaluation, contradicting zero trust's requirement to verify continuously rather than trusting a prior authentication event.
• DA flat network behind a single perimeter is the castle-and-moat model zero trust replaces, since it cannot make decisions about individual east-west requests.

A clientless TLS reverse proxy brokers encrypted access to named applications without joining the user to the network, granting least-privilege per-application reachability instead of subnet access.

• ASite-to-site VPNs interconnect fixed networks for branch offices, not individual roaming users, and they grant broad network reachability rather than scoped application access.
• BA full-tunnel client VPN places the device on the internal network with wide reachability, violating the requirement to restrict access to only specific applications.
• CSplit tunneling still extends layer-three network access to whole internal subnets, so users could reach far more than the few intended web applications.

Static data masking permanently substitutes realistic but fake values that preserve format and length, which is exactly suited for safe, functional non-production test datasets.

• BTokenization is designed for production substitution where a vault can reverse tokens back to real data, reintroducing the very PII exposure compliance wants eliminated in testing.
• CFull-disk encryption only protects data at rest from physical theft; once mounted, applications and developers still read the original real PII in plaintext.
• DHashing produces fixed-length irreversible digests that break original formatting and field semantics, so applications expecting realistic structured values would fail to function.

A hot site mirrors production with live replicated data and ready systems, enabling near-immediate failover, which directly satisfies the near-zero recovery time objective.

• AA cold site has no installed systems or current data, requiring lengthy provisioning and restoration, which makes a near-zero recovery time objective impossible to meet.
• BA warm site holds configured hardware yet still needs backup restoration and synchronization, introducing hours of delay that exceed a near-zero recovery time objective.
• DA mobile site must be transported and configured on demand after an event, so the travel and setup time make rapid near-zero failover unattainable.

Infrastructure as code provisions resources from declarative, version-controlled templates, producing identical repeatable environments and reducing configuration drift exactly as the scenario describes.

• AServerless abstracts away server management for executing functions on demand; it does not describe declaratively defining and provisioning infrastructure through version-controlled templates.
• CMicroservices is an application design pattern splitting software into independent services; it concerns code architecture rather than templated provisioning of underlying infrastructure resources.
• DContainerization bundles an application and its dependencies for portable execution, but it does not by itself define or provision the broader infrastructure through declarative templates.

VM escape is when malicious code breaks out of a guest virtual machine, compromises the underlying hypervisor, and reaches other tenant machines sharing that host, which is exactly the chain described here.

• AVM sprawl refers to uncontrolled creation of many virtual machines that waste resources and go unpatched, which is a management and hygiene problem rather than an attacker breaking through the hypervisor boundary.
• BResource exhaustion happens when one workload consumes so much CPU, memory, or storage that neighboring virtual machines are starved, causing denial of service rather than cross-tenant code execution on the host.
• DPrivilege creep describes a user gradually accumulating access rights beyond their job needs over time, an identity governance issue unrelated to a guest VM compromising the hypervisor and adjacent tenants.

Fail-open means that if the inline security appliance loses power or fails, it passes traffic through uninspected so the business keeps operating, accepting reduced security to preserve availability exactly as requested.

• BFail-closed means the device blocks all traffic when it fails, which maximizes security but produces exactly the outage the team is trying to avoid, so it directly contradicts the stated availability goal.
• CFail-secure is essentially a synonym for fail-closed, sealing the path shut on failure to protect data, so it likewise stops traffic and does not meet the requirement to keep business flows moving.
• DActive-active clustering improves availability by sharing load across redundant nodes, but it is a resilience design, not the per-device failure-mode behavior deciding whether a single failed appliance passes or blocks traffic.

Tokenization replaces the real card number with a random surrogate token containing no part of the original PAN, while the true value stays retrievable only inside a separate secure token vault.

• AData masking obscures characters, often showing only the last four digits, but the masked stored value generally cannot be reversed to recover the full PAN needed for later transaction reconciliation as required.
• BHashing is a one-way function, so once the PAN is hashed the original cannot be retrieved at all, which fails the requirement that the real number remain recoverable through a secure vault.
• CEncryption is reversible, yet the stored ciphertext is mathematically derived from the original PAN and still counts as protected card data, whereas the requirement is a surrogate containing no part of it.

A warm site keeps hardware and connectivity pre-installed and restores recent data within hours, balancing cost and recovery speed without the constant real-time mirroring expense of a fully operational hot site.

• AA hot site is a fully operational duplicate kept synchronized in real time and ready almost immediately, delivering faster recovery but costing far more than the partially provisioned facility the organization described.
• CA cold site provides only space, power, and cooling with no installed equipment or data, requiring lengthy setup, so it cannot restore operations within a few hours as the scenario explicitly requires.
• DA mirrored site continuously replicates every change to a duplicate environment in real time, matching a hot site's cost profile, which is precisely the always-running model the organization wanted to avoid.

SASE, secure access service edge, converges wide-area networking such as SD-WAN with cloud-delivered security services including secure web gateway, CASB, and zero-trust network access into one integrated offering.

• ASD-WAN by itself optimizes and routes wide-area traffic across links but provides no integrated cloud-delivered security stack, so it covers only the networking half of the converged model being described.
• BA unified threat management appliance bundles several security functions into one on-premises box, but it is hardware-centric and lacks the cloud-delivered, identity-driven networking convergence that defines the described model.
• DA VPN concentrator terminates encrypted remote-access tunnels at the network edge, providing connectivity for remote users but not the broad fusion of SD-WAN with cloud-delivered security services the question describes.

Because all containers on a host invoke the same kernel, a privilege-escalation kernel flaw can let one tenant escape to others, while per-VM kernels and the hypervisor enforce a stronger boundary.

• AContainers rely on kernel namespaces and cgroups, not the CPU ring model, and VMs use hardware-assisted virtualization, so their isolation mechanisms are not equivalent at all.
• CThis reverses reality: VMs run independent guest kernels and containers share the host kernel, so the claimed direction of isolation strength is backwards and misleading.
• DContainer runtimes, the shared kernel, and misconfigured capabilities all add escape surface, so claiming containers carry no breakout risk ignores documented container-escape vulnerabilities.

A bastion or jump server is the standard chokepoint allowing audited, authenticated administrative access into a segmented zone without permitting general routed traffic between corporate and OT networks.

• BAdding a route flattens the segmentation the design depends on, exposing fragile OT devices to the entire corporate broadcast and threat surface, which defeats the isolation requirement.
• CA reverse proxy is intended for publishing inbound services to clients, not for giving trusted internal administrators governed management access, and it does not enforce a session chokepoint for admin protocols.
• DSplit tunneling deliberately bypasses inspection and still requires reachability to the OT VLAN, so it weakens monitoring and does not provide the controlled single entry point segmentation needs.

Tokenization swaps the PAN for a same-length surrogate with no algorithmic link to the original, keeping mappings isolated in a protected vault and reducing scope in the analytics environment.

• AMasking with asterisks destroys the format and any usable value, breaking reports that still require 16 numeric digits and offering no way to reverse the data when legitimately needed.
• BFormat-preserving encryption keeps the length but the output is cryptographically derived from the original, so it does retain a mathematical relationship the team explicitly wanted to avoid.
• DA SHA-256 digest is a fixed 64-character hex string, not a 16-digit number, so it cannot preserve the required format and small PAN spaces are also vulnerable to brute forcing.

Clustering with heartbeat monitoring and a floating virtual IP lets the surviving node assume the failed node's identity and workload automatically, providing the high-availability failover described.

• ARound-robin DNS only distributes lookups and has no awareness of node health, so clients can still be sent to a dead node and no automatic identity takeover occurs.
• BLoad balancing optimizes distribution of work for performance, but balancing requests is not the same as one node assuming a failed node's identity and state during a failure.
• CBackups support recovery after data loss but require a restore process, so they cannot deliver the automatic, near-seamless node takeover the continuous transaction requirement demands.

Data sovereignty means information is subject to the laws of the country where it resides, and residency controls where copies physically live, exactly the cross-border replication issue raised here.

• AMasking hides field-level values but does nothing to constrain the geographic location of where the records and their replicas are stored, which is the auditors' actual concern.
• CClassification assigns sensitivity labels to guide handling, yet it does not by itself dictate the physical storage location or which nation's legal jurisdiction governs the data.
• DDLP monitors and blocks unauthorized data egress over channels like email or web, but it does not address lawful provider replication crossing into a prohibited geographic region.

802.1X enforces port-based authentication via EAP and a RADIUS backend before granting access, validating device or user identity right at the switch port.

• AMAC filtering is easily bypassed because an attacker can spoof an approved MAC address, so it does not truly authenticate the connecting device.
• CDHCP snooping only blocks rogue DHCP servers and validates leases; it does nothing to authenticate which devices are permitted to connect to the port.
• DDisabling unused ports reduces attack surface but provides no authentication for the active conference-room jacks that employees still need to use daily.

Hashing produces a fixed one-way digest that changes if any bit is altered, letting the analyst verify integrity by comparing against the vendor's published value.

• BEncryption protects confidentiality and is reversible with the key, but it does not by itself prove that the downloaded file's contents were not tampered with.
• CObfuscation only makes code harder to read or reverse-engineer; it provides no mechanism to detect whether the firmware image was modified during transit.
• DMasking replaces sensitive values with realistic substitutes for privacy in lower environments, which has nothing to do with verifying the integrity of a firmware file.

A generator supplies sustained power for hours or days once fueled, taking over from the UPS so the data center keeps running through long outages.

• AA UPS only bridges brief gaps using batteries and is already deployed; stacking more of them still cannot sustain a multi-hour outage on its own.
• BDual power supplies protect against a single supply failing inside a server, but they still depend entirely on incoming utility power remaining available.
• DA PDU distributes and meters power to racks but generates none itself, so it cannot keep equipment running once the utility feed is lost.

Serverless functions auto-scale per invocation and bill only for execution time, removing server management while matching the bursty, pay-per-use requirement exactly.

• AA fixed VM fleet requires capacity planning and pays for idle resources during quiet periods, contradicting the goal of paying only for actual compute used.
• BMicroservices improve modularity but still run on infrastructure the team must provision, patch, and scale, so they do not eliminate server management work.
• CA monolith couples all functions together and scales as one unit, making it costly and slow to handle unpredictable bursty request volumes efficiently.

A forward proxy sits between internal clients and the internet to filter, log, and cache outbound requests, centralizing control over employee web browsing.

• BA reverse proxy fronts internal servers to handle inbound requests from external clients, which is the opposite traffic direction from employee outbound browsing.
• CA load balancer distributes incoming connections across backend servers for availability, but it does not filter, log, or cache employees' outbound web traffic.
• DA jump server provides a hardened administrative pivot into secure zones, not a chokepoint for inspecting general employee outbound internet browsing.