High availability, site resilience and power

Objective 3.4 in this course covers resilience and recovery — CompTIA's scope note for it explains high availability, site considerations, testing, power, platform diversity, backups and continuity of operations. This lesson takes availability, sites, platform diversity and power; backups, testing and continuity are the next lesson.

Why this matters

Availability is a third of the CIA triad and it is the one security people neglect, because it feels like an operations concern. It is not: ransomware, denial of service, wipers and destructive attacks are all attacks on availability, and the controls in this lesson are what answer them.

The exam also uses this objective for arithmetic. RPO, RTO, MTBF and MTTR appear here and again in Domain 5's business impact analysis, and you will be asked to derive one from a described requirement.

The lesson

Load balancing versus clustering, and what each survives

Both provide availability across multiple systems, and CompTIA distinguishes them.

Load balancing distributes incoming requests across several independent servers. Each server can handle any request; the balancer spreads the work and removes any node that fails its health check. It provides both capacity and availability, and it is the standard answer for stateless web tiers.

Things worth knowing: health checks are what make it a resilience control rather than only a performance one; session persistence (sticky sessions) sends a user back to the same node, which is convenient for applications that hold session state locally and which undermines even distribution; and the balancer itself must be redundant or it is the single point of failure it was deployed to remove.

Clustering joins several systems so they act as one, sharing state. Active-active means all nodes serve traffic — you get capacity and availability, at the cost of coordination complexity. Active-passive means one node serves and another stands ready — simpler, with a failover delay, and the passive node is idle capacity you are paying for.

The distinction the exam draws: load balancing suits stateless workloads where any server can answer; clustering suits stateful ones — databases, file services — where nodes must share or replicate state. Clustering survives a node failure with the state intact; load balancing alone does not, because the state was never shared.

Both survive a single node failure. Neither survives the site.

Hot, warm, cold sites and geographic dispersion

Site resilience is what survives the loss of a whole location. The three standard types, distinguished by how much is ready before the disaster:

• Hot site — fully equipped, data replicated and current, staff can begin work in minutes to hours. Most expensive, shortest recovery.
• Warm site — hardware and connectivity in place, data restored from backup when needed. Recovery in hours to days. Middle cost.
• Cold site — space, power and connectivity, nothing else. Equipment must be procured or moved and data restored. Recovery in days to weeks. Cheapest.

The selection driver is the recovery time objective, and the exam asks it that way: an RTO of four hours rules out a cold site; an RTO of two weeks makes a hot site an expensive luxury.

Geographic dispersion is the requirement that the alternate site be far enough away to be unaffected by the same event. A secondary data centre ten miles away survives a building fire and not a regional flood, storm or power grid failure. The distance is chosen against the threats in your risk assessment; the trade is latency — synchronous replication has a distance limit imposed by the speed of light, so very distant sites mean asynchronous replication and therefore a non-zero RPO.

Related: multi-cloud and multi-region are the same idea expressed in cloud terms, and the same distance-versus-latency trade applies.

Platform diversity and multi-cloud as a resilience control

Platform diversity means not depending on a single vendor, operating system, or technology for everything. If all of your servers run the same OS at the same patch level, a single vulnerability or a single bad update affects all of them simultaneously — a common mode failure.

The security argument is genuine: monocultures fail together. A worm exploiting one platform takes everything; a flawed update from one vendor bricks the entire fleet, which has happened at global scale.

The cost is equally genuine and the exam expects you to name it: diversity multiplies the operational burden. Two platforms means two sets of hardening standards, two patch cycles, two skill sets, two monitoring integrations — and more total vulnerabilities, because you now have the union of both platforms' flaws. Poorly run diversity is less secure than a well-run monoculture.

Where diversity is most defensible is at the layers where failure is total: having more than one internet provider, more than one cloud provider for the most critical workload, more than one authentication path so a single identity provider outage does not lock everyone out, and — importantly — backup software and storage that is not the same technology as production, so that whatever destroyed production cannot reach the recovery copy.

UPS, generators, and the runtime figure that makes them useful

Power is the dependency underneath every other control, and CompTIA examines the two tiers.

• An uninterruptible power supply (UPS) carries the load from the instant mains power fails. It is battery-backed, it engages with no gap, and it runs for minutes. Its jobs are to ride out brief interruptions and to keep systems up long enough for a generator to start or for a clean shutdown.
• A generator provides power for hours to days, limited by fuel. It takes time to start and stabilise — typically tens of seconds — which is exactly the gap the UPS covers.

They are not alternatives. The design is UPS and generator, in series: UPS for the transition, generator for the duration.

The numbers that make this real, and the kind of detail exam scenarios hinge on:

• UPS runtime at actual load. The rated runtime assumes a load; at double that load it is far less than half. Racks grow, and the runtime that was eight minutes at installation may be two.
• Batteries age and must be tested and replaced on a schedule. A UPS whose batteries have never been load-tested is an assumption, not a control.
• Generator fuel has a finite supply and a delivery dependency. A seventy-two-hour tank needs a refuelling contract that will be honoured during a regional event, when everyone else wants fuel too.
• Generators must be tested under load, regularly. A generator that starts but cannot carry the load, or that has not run in a year and fails after twenty minutes, is the classic finding.

Supporting items CompTIA names: dual power supplies in each device fed from separate circuits, managed power distribution units, and surge protection.

The sentence to carry into the exam: UPS covers seconds to minutes, generators cover hours to days, and both are only real if they are tested under load.

Capacity planning for people, technology and infrastructure

CompTIA lists capacity planning under resilience and splits it three ways, which is unusual enough to be worth remembering.

• People. Enough trained staff to run and recover the service — and enough that a single person being unavailable does not stop recovery. The failure is the key-person dependency: one administrator who is the only one who can restore the database. Cross-training, documented runbooks and on-call rotas are the controls, and they double as an insider-threat control, because mandatory holidays and job rotation come from the same place.
• Technology. Enough compute, storage, bandwidth and licences for normal load, for peak, and for the degraded state during failover — where remaining capacity must carry the whole load. A failover design where the secondary can carry only 60% of production is a design that fails when used.
• Infrastructure. Power, cooling, rack space and physical capacity, with the same headroom logic.

Capacity is a security concern because exhaustion is an availability failure, and it is one attackers deliberately cause. A denial of service attack is capacity exhaustion by an adversary; log storage filling up so that new events are dropped is capacity exhaustion that blinds your detection; a licence limit reached during an incident is capacity exhaustion at the worst possible moment.

What to take into the exam

• Load balancing suits stateless workloads; clustering shares state and suits databases and file services. Neither survives the site.
• Hot/warm/cold is chosen by RTO: hours means hot, days means warm, weeks can be cold.
• Geographic dispersion must exceed the reach of the threat, and distance costs you synchronous replication.
• Platform diversity prevents common mode failure and multiplies operational burden and total vulnerabilities.
• UPS = minutes, generator = hours to days, and both must be tested under load.
• Capacity planning covers people as well as technology, and the failover target must carry full production load, not partial.