Architecture Considerations
Security architecture trade-offs including availability, resilience, cost, responsiveness, scalability, RTO/RPO, risk transference, and deployment ease. Understanding these factors is essential for designing secure and practical systems.
Understanding Architecture Considerations
Security architecture requires balancing multiple considerations—availability, cost, performance, and resilience. Understanding these trade-offs is essential for designing systems that are both secure and practical.
Key architecture considerations: • Availability — System uptime requirements • Resilience — Ability to recover from failures • Cost — CapEx, OpEx, and total cost of ownership • Responsiveness — Performance and latency • Scalability — Handling growth and demand • Recovery — RTO and RPO objectives • Risk transference — Insurance and third-party risk
AWS's 2017 S3 outage took down large portions of the internet for hours because many companies relied on a single region without redundancy—proving that high availability requires intentional architecture, not assumptions.
Architecture decisions must balance security requirements with business constraints and operational realities.
Why This Matters for the Exam
Architecture considerations are heavily tested on SY0-701 as they connect security to business requirements. Questions cover availability metrics, recovery objectives, and cost trade-offs.
Understanding these trade-offs helps with security planning, disaster recovery, and risk management. Security architectures that ignore business realities fail.
The exam tests understanding of metrics (RTO, RPO, availability) and their implications for security design.
Deep Dive
What Do Availability "Nines" Mean?
Availability measures system uptime as a percentage.
Availability Levels:
| Availability | Downtime/Year | Common Name |
|---|---|---|
| 99% | 3.65 days | Two nines |
| 99.9% | 8.76 hours | Three nines |
| 99.99% | 52.56 minutes | Four nines |
| 99.999% | 5.26 minutes | Five nines |
| 99.9999% | 31.5 seconds | Six nines |
Achieving High Availability:
- •Load balancing
- •Clustering
- •Redundant components
- •Geographic distribution
- •Automatic failover
Cost vs Availability:
Higher nines = Exponentially higher cost 99% → 99.9% = Significant investment 99.9% → 99.99% = Major investment 99.99% → 99.999% = Massive investment
What Is Resilience and How Do You Build It?
Resilience is the ability to withstand and recover from failures.
Resilience Components:
| Component | Description |
|---|---|
| Fault tolerance | Continue operating despite failures |
| Redundancy | Duplicate critical components |
| Recovery | Restore after failure |
| Adaptability | Adjust to changing conditions |
Building Resilience:
- •Eliminate single points of failure
- •Implement redundancy at all layers
- •Regular testing and drills
- •Automated recovery procedures
- •Geographic distribution
What Is the Difference Between RTO and RPO?
Recovery Objectives:
| Metric | Definition | Question Answered |
|---|---|---|
| RTO | Recovery Time Objective | How long can we be down? |
| RPO | Recovery Point Objective | How much data can we lose? |
RTO Example:
Outage at 2:00 PM RTO = 4 hours System must be operational by 6:00 PM
RPO Example:
Backup at 6:00 AM Failure at 2:00 PM RPO = 4 hours Maximum 4 hours of data loss acceptable
RTO and RPO Relationship:
- •Lower RTO = Faster recovery needed = Higher cost
- •Lower RPO = Less data loss acceptable = More frequent backups = Higher cost
What Are Hot, Warm, and Cold Sites?
Recovery Site Comparison:
| Site Type | RTO | Cost | Description |
|---|---|---|---|
| Hot site | Minutes | High | Fully operational duplicate |
| Warm site | Hours | Medium | Partial equipment, needs config |
| Cold site | Days | Low | Empty facility, needs everything |
Hot Site:
- •Fully equipped and running
- •Real-time data replication
- •Immediate failover capability
- •Highest cost, lowest RTO
Warm Site:
- •Equipment present but not running
- •Data restored from backups
- •Hours to become operational
- •Balance of cost and recovery time
Cold Site:
- •Empty facility, power, and network only
- •All equipment must be sourced
- •Days to become operational
- •Lowest cost, highest RTO
How Do Scalability Types Differ?
Scalability Comparison:
| Aspect | Vertical | Horizontal |
|---|---|---|
| Complexity | Simple | Complex |
| Limit | Hardware max | Virtually unlimited |
| Resilience | Single point | Distributed |
| Cost pattern | Expensive increments | Linear growth |
What Cost Models Apply to Security Architecture?
Cost Types:
| Type | Definition | Examples |
|---|---|---|
| CapEx | Capital Expenditure | Hardware, facilities |
| OpEx | Operational Expenditure | Cloud services, subscriptions |
| TCO | Total Cost of Ownership | All costs over lifecycle |
Security Cost Trade-offs:
- •Higher availability = Higher cost
- •Better security = More investment
- •Redundancy = Duplicate expenses
- •Cloud shifts CapEx to OpEx
How Do You Transfer Security Risk?
Risk Transference Methods:
| Method | Description |
|---|---|
| Insurance | Financial compensation for incidents |
| Cloud services | Provider assumes some risks |
| Outsourcing | Third party assumes operations |
| Contracts | Transfer liability via agreements |
What Risk Transference Does NOT Do:
- •Eliminate risk entirely
- •Transfer reputational damage
- •Remove regulatory responsibility
- •Cover all potential losses
How CompTIA Tests This
Example Analysis
Scenario: A financial services company needs to design a disaster recovery solution. Requirements: maximum 1 hour of downtime (RTO), maximum 15 minutes of data loss (RPO), and budget constraints require cost optimization.
Analysis - Recovery Architecture Design:
Requirements Analysis:
| Requirement | Value | Implication |
|---|---|---|
| RTO | 1 hour | Hot or warm site needed |
| RPO | 15 minutes | Near real-time replication |
| Budget | Constrained | Can't do unlimited spending |
Site Selection:
Cold Site:
- •RTO: Days ❌ (doesn't meet 1 hour)
- •Cost: Low ✓
- •Verdict: Does not meet RTO requirement
Warm Site:
- •RTO: Hours ❌ (borderline, risky for 1 hour)
- •Cost: Medium ✓
- •Verdict: May not reliably meet RTO
Hot Site:
- •RTO: Minutes ✓ (easily meets 1 hour)
- •Cost: High (budget concern)
- •Verdict: Meets requirements but expensive
Recommended Solution:
Cost Optimization:
- •Use cloud for DR (pay for standby, not full)
- •Right-size standby resources
- •Scale up only during failover
- •Multi-region cloud deployment
Trade-offs:
- •Slightly higher RTO than full hot site
- •Lower cost than traditional hot site
- •Meets both RTO and RPO requirements
- •Acceptable budget impact
Key insight: RTO and RPO drive recovery architecture. The 15-minute RPO requires continuous or near-continuous replication. The 1-hour RTO requires hot or optimized warm site. Cloud enables cost-effective hot site alternatives.
Key Terms
Common Mistakes
Exam Tips
Memory Trick
RTO vs RPO - The Two Questions:
RTO = "Recovery Time" = "How long can we be Turned off?" RPO = "Recovery Point" = "How much data can we Permanently lose?"
Recovery Sites - Temperature Memory: Think of how much "heat" (activity) is at each site:
Hot 🔥 = Running hot right now (minutes to failover) Warm 🌡️ = Equipment there but cooling (hours to start) Cold ❄️ = Empty and cold (days to equip)
The "Nines" Pattern: "Every nine you add, the cost goes sky-high" 99% → 3.6 days down 99.9% → 8.7 hours down 99.99% → 52 minutes down (most common exam reference) 99.999% → 5 minutes down
Scaling Memory: Vertical = "Very big server" (scale UP ↑) Horizontal = "Herd of servers" (scale OUT →)
Cost Type Memory: CapEx = Capital = Buy a cap (one-time purchase) OpEx = Operations = Operating expenses (ongoing)
Test Your Knowledge
Q1.A company requires that systems be restored within 2 hours of failure and can tolerate losing up to 30 minutes of data. What are these requirements called?
Q2.Which disaster recovery site type provides the FASTEST recovery but at the HIGHEST cost?
Q3.What availability percentage allows approximately 52 minutes of downtime per year?
Want more practice with instant AI feedback?
Continue Learning
Ready for the Exam?
See exactly where you stand on this concept and 182 others.
99% pass rate · Pass guarantee