Study guide 6: Secure cloud architecture, embedded systems and zero trust
Domain 3: Security Architecture · Not started
Main exam topics
Cloud and on-premises systems; virtualization, containers and industrial systems; shared responsibility; secure infrastructure and communications; segmentation and firewalls; protecting data at rest, in transit and in use; encryption, DLP, backups, redundancy and recovery.
SY0-701 topic overview · Independent study resource, not a prediction of exam questions.
Lesson plan · 75 minutes
By the end of this lesson you will be able to:
- Apply the shared responsibility model to IaaS, PaaS and SaaS
- Explain IaC, serverless, microservices and containers
- Identify risks of embedded, ICS/SCADA and IoT systems
- Describe zero trust control and data planes
Topic 6A — Cloud infrastructure
Deployment models are public, private, community and hybrid. In IaaS the customer secures OS and up; in PaaS, code and data; in SaaS, mainly data and identities. The customer always owns data classification and access. Infrastructure as code defines environments in templates, improving consistency but making template errors spread. Serverless and microservices reduce server management but increase API exposure. Containers share a host kernel and need image scanning. CASBs enforce policy between users and cloud apps.
Topic 6B — Embedded systems and ICS
Embedded systems and IoT devices often have weak defaults, long lifecycles and limited patching. Industrial control systems and SCADA control physical processes, where availability and safety come first. Protect them with segmentation, monitoring and strict vendor access. RTOS devices need vendor-supported updates.
Topic 6B — Zero trust
Zero trust means never trust by location; verify every request. A policy engine decides, a policy administrator issues the decision, and a policy enforcement point allows or blocks — that is the control plane, while the data plane carries traffic. Adaptive identity, threat scope reduction and microsegmentation reduce implicit trust zones.
Saved