Domain 3: Architecture — The Hardest Domain Explained
Domain 3 is where most students struggle. It's abstract, covers a lot of ground, and the exam asks you to apply concepts, not just recall them.
> Domain weightings are set by CompTIA and change with each exam version — confirm the current objectives at comptia.org.
Why It's Hard
The other domains test knowledge. Domain 3 tests understanding. You'll get scenarios like "a company wants to allow remote workers to access internal resources securely — which architecture should they use?" You need to think, not just remember.
Key Topics
Network Architecture
- DMZ, VPN, SD-WAN, SASE
- Network segmentation and microsegmentation
- Jump servers / bastion hosts
- Load balancing and reverse proxies
Cloud Security
- IaaS, PaaS, SaaS — shared responsibility for each
- Cloud-native security controls (security groups, WAF, KMS)
- Containerisation and serverless security considerations
- Multi-cloud and hybrid cloud architectures
Resilience and Recovery
- High availability (HA), fault tolerance, redundancy
- RAID levels (0, 1, 5, 6, 10) — know the differences
- Backup types: full, incremental, differential, snapshot
- RPO and RTO — what they mean and how to calculate them
- Site types: hot, warm, cold
Infrastructure Concepts
- IaC (Infrastructure as Code)
- Embedded systems and IoT security
- SCADA/ICS security basics
Study Tips
Draw diagrams. Seriously — sketch out network architectures, cloud responsibility models, and backup strategies. Visual learners do much better on Domain 3 than flashcard-only studiers.