Security Architecture, Engineering, and Operations
What the exam tests
Architecture, engineering, and operations questions test whether you can choose controls that hold up under failure, change, and attack. Topics include secure design principles, segmentation and zero trust, cryptographic selection, identity and access management, hardening and configuration baselines, vulnerability and patch management, logging, and the shared-responsibility model in cloud.
Core rules
- Defense in depth, not defense in one place. Layer preventive, detective, and corrective controls so a single failure is not fatal.
- Least privilege and separation of duties apply to people, service accounts, and automation.
- Segment trust boundaries. Put public web tiers in a DMZ, keep data stores in private subnets, and require authenticated, encrypted paths between tiers.
- Match the cryptographic tool to the job. Hashing (SHA-256) checks integrity; symmetric encryption (AES-256) protects data at rest; TLS protects data in transit; digital signatures provide integrity, authentication, and non-repudiation.
- Change and configuration management are security controls. Unmanaged change is a common route to unplanned outage or exposure.
- Cloud: the provider secures the cloud; the customer secures what they put in it.
Worked example
A three-tier application places the web server, application server, and database in one flat subnet, with the application using the database's administrative account. Reasoning: flat subnets remove the trust boundary, so a web compromise reaches the database directly. Fix by segmenting each tier, allowing only the application port from app tier to database, replacing the admin account with a least-privilege service account, enforcing TLS between tiers, and adding database activity monitoring as a detective control. This is engineering, not just policy.
Traps
- Treating encryption as a substitute for authorization.
- Using hashing where you need to recover the original value.
- Forgetting compensating controls when a legacy system cannot be patched.
- Assuming the cloud provider's certification covers your application configuration.