How should I use these Security Architecture practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Security Architecture questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Security Architecture domain.

CAS-004 · topic practice

Security Architecture practice questions

Practise CompTIA SecurityX CAS-004 Security Architecture practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Security Architecture

Practice 10 questions Browse domain →

What the exam tests

What to know about Security Architecture

Security Architecture questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Security Architecture exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Security Architecture questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full Security Architecture explanation →

A company is implementing a zero trust architecture. Which of the following BEST describes the principle of micro-segmentation in this model?

Trap 1: Creating a single perimeter around the entire network

This describes traditional perimeter security, not micro-segmentation.

Trap 2: Using VLANs to separate departments

VLANs are a form of segmentation but not as granular as micro-segmentation at the workload level.

Trap 3: Implementing a VPN for remote access

VPN is a connectivity method, not a zero trust segmentation technique.

Study all Security Architecture common traps →

A
Creating a single perimeter around the entire network
Why wrong: This describes traditional perimeter security, not micro-segmentation.
B
Isolating workloads at the virtual network interface level with granular security policies
This accurately defines micro-segmentation in a zero trust model.
C
Using VLANs to separate departments
Why wrong: VLANs are a form of segmentation but not as granular as micro-segmentation at the workload level.
D
Implementing a VPN for remote access
Why wrong: VPN is a connectivity method, not a zero trust segmentation technique.

Security Architecture practice questions

What to know about Security Architecture

Common Security Architecture exam traps

Security Architecture questions

A company is implementing a zero trust architecture. Which of the following BEST describes the principle of micro-segmentation in this model?

An organization is adopting a cloud-first strategy and wants to ensure proper security responsibilities are understood. Which concept defines the division of security responsibilities between the cloud provider and the customer?

A security architect is designing a hybrid cloud environment with workloads in AWS and on-premises. The architect needs to ensure secure, low-latency connectivity between the two environments without traversing the internet. Which solution should be used?

A company is deploying a cloud access security broker (CASB) to gain visibility into shadow IT. Which mode of operation would allow the CASB to inspect traffic without requiring proxy configuration on endpoints?

A security analyst needs to ensure that only authorized containers run in a Kubernetes cluster. Which Kubernetes native security control should be configured?

An organization is concerned about quantum computer attacks on its current cryptographic infrastructure. Which of the following NIST-approved post-quantum cryptographic algorithms is designed for key encapsulation?

During a security assessment, a penetration tester discovers that a web application fails to validate the size of user input, leading to a buffer overflow. Which application security control would have BEST prevented this vulnerability?

An organization wants to enforce that only signed container images are deployed in production. Which of the following should be implemented?

A company is deploying a SASE architecture. Which component is responsible for securing web traffic and enforcing acceptable use policies at the edge?

A security architect is designing a PKI for a large enterprise. Which component is used to protect private keys and perform cryptographic operations in a tamper-resistant environment?

During an API security review, an assessor finds that the API uses JSON Web Tokens (JWT) with a symmetric key shared among multiple services. Which of the following is the MOST significant security concern?

An organization wants to enforce consistent security policies across multiple cloud providers (AWS, Azure, GCP). Which tool is designed to continuously monitor and remediate misconfigurations in cloud environments?

A security architect is designing a supply chain security program. Which TWO of the following are essential components of a software bill of materials (SBOM) strategy? (Select TWO.)

An organization is migrating to a zero trust model and wants to implement identity-centric security. Which THREE of the following are key principles of an identity-centric zero trust approach? (Select THREE.)

A company is implementing a defense-in-depth strategy for its web application. Which THREE of the following are layers that should be included? (Select THREE.)

A security architect is designing a zero-trust architecture for a multi-cloud environment. Which principle is essential for enforcing identity-centric micro-segmentation?

An organization is adopting a cloud-first strategy and needs to ensure compliance with SOC 2. Which cloud service model places the most responsibility on the customer for security?

A security engineer is deploying a Cloud Access Security Broker (CASB) to protect a SaaS application. Which deployment mode allows the CASB to inspect encrypted traffic without requiring client software?

A company needs to connect its on-premises data center to a public cloud provider with low latency and high bandwidth while avoiding the public internet. Which connectivity method should be used?

A security architect is reviewing a Secure Access Service Edge (SASE) implementation. Which component of SASE provides security inspection for all traffic, regardless of location?

Track your progress over time

Start a Security Architecture only practice session

Related CAS-004 topic practice pages

Scripting, Containers and Automation practice questions

Application Environment, Configuration and Security practice questions

Security Architecture practice questions

Security Engineering and Cryptography practice questions

Security Operations practice questions

Governance, Risk, and Compliance practice questions

Governance, Risk and Compliance practice questions

Security Engineering practice questions

CAS-004 fundamentals practice questions

CAS-004 scenario practice questions

CAS-004 troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid