Architect infrastructure and system security
Domain 5 tests designing layered infrastructure that contains compromise and supports recovery.
Design principles
Apply least privilege, deny by default, fail secure, and defense in depth. Segment by trust level and data classification: DMZ, application, data, and management planes, with east-west controls (microsegmentation, service-mesh mTLS). Separate control plane from data plane. Use immutable infrastructure, infrastructure-as-code scanning, secrets management, and supply-chain controls (SBOM, signed artifacts, SLSA). In cloud, the shared responsibility model splits provider and customer duties by service model: IaaS leaves OS, patching, and identity to the customer.
Core building blocks
Hardened compute baselines (CIS Benchmarks), endpoint detection, storage and backup encryption with customer-managed keys, HSM/KMS envelope encryption, key rotation and crypto-shredding, resilience across zones, immutable backups with Object Lock, centralized logging to a separate account with integrity controls, SIEM correlation, WAF, DDoS protection, CASB/SASE for SaaS and remote access, and zero trust policy enforcement points (NIST SP 800-207).
Worked example
A three-tier web application on a public cloud. Design: public load balancer in a DMZ subnet; application tier private; database private with no internet route; VPC endpoints for service access; per-tenant KMS customer-managed keys; an organization trail to an immutable log archive account with Object Lock; GuardDuty and Config rules. Reasoning: segmentation limits lateral movement, customer-managed keys enable crypto-shredding at offboarding, and separated immutable logs preserve forensics if the workload account is compromised. Map to NIST SP 800-53 SC-7, SC-28, and AU-9.
Traps
Perimeter-only thinking; flat internal networks; long-lived static credentials; unencrypted backups; logs stored with the workload they monitor; assuming the provider secures customer data; ignoring east-west traffic; over-broad security groups.