4. Security Architecture (18%)

This domain covers exam objectives 3.1 through 3.4 and accounts for roughly 16 of the 90 questions. Where Phase 3 taught you the threats, Phase 4 teaches you how to design systems that resist them. Security architecture is about making good decisions before deployment — choosing the right infrastructure model, placing controls in the right locations, protecting data at every stage, and building resilience so that failures don't become catastrophes. The exam tests your ability to look at an architecture and identify what's missing, misconfigured, or inappropriately placed.