Security+ Domain 3 · SY0-801
How architecture choices shift risk, from on-premises networks to multicloud, and how to run secure infrastructure, protect data through its life and keep services running when something fails.
Each block is as wide as that domain’s share of SY0-801. Domain 3 is 19%, up from 18% in SY0-701. Weights: CompTIA’s published SY0-801 exam objectives (v2.0).
The four objectives
Think of the four objectives as layers: where systems run, the infrastructure around them, the data inside, and what keeps it all available.
How on-premises, the cloud deployment models, multicloud, serverless, microservices, infrastructure as code and operational technology each shift responsibilities and risk, and the business and technical factors behind the choice.
Typical question: a situation with a constraint, such as data sovereignty or a system that can’t be patched, and you pick the architecture that fits.
Where controls go, how zones connect, what happens when a control fails, the building blocks of a Zero Trust architecture, secure remote and out-of-band access, Security Service Edge, service accounts and privilege hygiene.
Typical question: a small network or remote-work setup with a requirement, and you choose the design change or placement that BEST meets it.
Data types, states and classifications, the techniques that protect them, handling across locations and devices, who is accountable, and the life cycle from creation to disposal.
Typical question: a piece of data or a handling need, and you name its state or class, or the technique that protects it.
Designing systems to keep running and to recover: high availability and scaling, recovery sites, backups (now including immutability and restore testing), power, continuity versus disaster recovery, and the recovery metrics RTO, RPO, MTTR and MTBF.
Typical question: a business requirement or outage story, and you pick the resilience measure or metric that applies.
Objective titles and summaries are our own words, not CompTIA’s. See every objective in the Security+ exam objectives checklist.
Domain test
25 questions in 25 minutes, covering all four objectives, with one PBQ. Your results show how you did on each objective, so you know what to drill next.
Security Architecture, every objective, on a timer.
SY0-801 vs SY0-701
The same four objectives, with new contents. Zero Trust architecture and Security Service Edge arrive in 3.2, data protection roles move in from Domain 5, and recovery metrics such as RTO and RPO move into 3.4. The data objective now asks you to summarize rather than compare and contrast.
SY0-701SY0-801
| SY0-801 | What it covers | From SY0-701 | Change |
|---|---|---|---|
3.1 | Security implications of architecture models | 3.1 | Same title |
3.2 | Managing secure infrastructure | 3.2 | Reworded |
3.3 | Protecting data | 3.3 | Reworded |
3.4 | Resilience and recovery | 3.4 | Same title |
CompTIA says its lists of examples aren’t exhaustive, so don’t forget the terms it no longer names, but don’t make them your focus. Read the full SY0-801 vs SY0-701 guide.
Try a question
The four-question demo runs in the same player as the full tests, with a timer, flags and an explanation for every option when you finish.
Objective 3.4: which two measures keep a recent backup safe from ransomware launched with stolen domain administrator credentials? Six options, and each one is explained.
Every full mock test weights the domains like the exam, so Mock Test 1 includes 16 Security Architecture questions plus a network placement PBQ.
FAQ
Domain 3, Security Architecture, covers how architecture models change your risk, how to run secure infrastructure, how to protect data and how to build resilience and recovery. It’s 19% of SY0-801 and has four objectives.
Both. Objective 1.1 covers Zero Trust as a principle: verify every request, grant least privilege and assume a breach. Objective 3.2 covers the architecture that delivers it, such as user authentication, device health and inventory, and application access control.
They aren’t named in the published SY0-801 objectives, although some early previews mentioned them. The objectives list Security Service Edge (SSE) instead. CompTIA says its lists of examples aren’t exhaustive, so know what SASE and SD-WAN are, but don’t make them the focus of your study.
The recovery time objective (RTO) is the longest a service can be down before the impact is unacceptable. The recovery point objective (RPO) is the most data you can afford to lose, measured in time, so an RPO of 15 minutes means backups or replication at least every 15 minutes. In SY0-801 both sit in objective 3.4.
Take the timed Domain 3 test, or start with Mock Test 1: a free, full-length Security+ practice exam, explained option by option.
