Architecture models and cloud
Domain 3: Security Architecture · Not started
Main exam topics
Cloud and on-premises systems; virtualization, containers and industrial systems; shared responsibility; secure infrastructure and communications; segmentation and firewalls; protecting data at rest, in transit and in use; encryption, DLP, backups, redundancy and recovery.
SY0-701 topic overview · Independent study resource, not a prediction of exam questions.
Where responsibility sits
In every cloud service the provider and customer share security duties. With IaaS the provider secures the physical data center, hardware, and hypervisor, while the customer secures the operating system, applications, data, and identities. With PaaS the provider also manages the operating system and runtime, so the customer focuses on code, data, and access. With SaaS the provider runs almost everything; the customer still owns its data, user accounts, and configuration choices. Exam questions often describe a breach and ask who was responsible. A publicly exposed storage bucket is nearly always a customer configuration failure.
On-premises, cloud, and hybrid
On-premises gives full control and full responsibility, including power, cooling, and physical security. Public cloud offers elasticity and faster deployment but introduces dependency on the provider and new risks such as misconfiguration and weak API keys. Hybrid combines both and requires consistent identity, logging, and policy across environments. Multi-cloud reduces dependence on one vendor but increases complexity.
Modern building blocks
Infrastructure as code defines servers and networks in templates, which makes builds repeatable and reviewable but spreads mistakes quickly if a template is wrong. Serverless functions remove server management but still need least-privilege permissions. Containers package applications with dependencies; they share the host kernel, so they isolate less strongly than virtual machines. Microservices split applications into small services that communicate over APIs, which must be authenticated and rate limited.
Exam approach
Identify the service model first, then decide which party controls the failing layer. For architecture choices, look for the option that balances control, cost, and responsibility in the scenario rather than the most technically impressive answer.
Know the difference: Customer duties by service model
| Model | Provider manages | Customer manages |
|---|---|---|
| IaaS | Hardware, hypervisor | OS, apps, data, identities |
| PaaS | Hardware through runtime | Code, data, identities |
| SaaS | Nearly entire stack | Data, users, settings |
Saved