Study guide
7.2 Secure Data Center Design (Domain 3.2)
Certified Cloud Security Professional CCSP
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 Current CCSP Exam Facts 1.2 CAT Format, Scoring & Logistics 1.3 Eligibility, Experience & Certification Maintenance
2 Domain 1: Cloud Concepts & Architecture Foundations
2.1 Cloud Computing Concepts (Domain 1.1) 2.2 Cloud Reference Architecture (Domain 1.2) 2.3 Security Concepts Relevant to Cloud (Domain 1.3)
3 Domain 1: Secure Design, CSP Evaluation & AI/ML
3.1 Design Principles of Secure Cloud Computing (Domain 1.4) 3.2 Evaluate Cloud Service Providers (Domain 1.5) 3.3 AI/ML in Cloud Security (Domain 1.6)
4 Domain 2: Data Concepts, Storage & Protection Technologies
4.1 Cloud Data Concepts (Domain 2.1) 4.2 Cloud Data Storage Architectures (Domain 2.2) 4.3 Data Security Technologies & Strategies (Domain 2.3)
5 Domain 2: Discovery, Classification & Information Rights Management
5.1 Data Discovery (Domain 2.4) 5.2 Data Classification (Domain 2.5) 5.3 Information Rights Management (Domain 2.6)
6 Domain 2: Retention, Auditability & AI/ML Data Protection
6.1 Retention, Deletion & Archiving (Domain 2.7) 6.2 Auditability, Traceability & Accountability (Domain 2.8) 6.3 AI/ML Data Protection (Domain 2.9)
7 Domain 3: Infrastructure Components, Data Center & Risks
7.1 Cloud Infrastructure Components (Domain 3.1) 7.2 Secure Data Center Design (Domain 3.2) 7.3 Infrastructure & Platform Risks (Domain 3.3)
8 Domain 3: Security Controls & Business Continuity / Disaster Recovery
8.1 Security Controls Implementation (Domain 3.4) 8.2 Business Continuity & Disaster Recovery (Domain 3.5)
9 Domain 4: Application Security Awareness & Secure SDLC
9.1 Application Security Training & Awareness (Domain 4.1) 9.2 Secure SDLC Process (Domain 4.2) 9.3 Apply Secure SDLC (Domain 4.3)
10 Domain 4: Software Assurance, Architecture & IAM
10.1 Cloud Software Assurance & Validation (Domain 4.4) 10.2 Verified Secure Software (Domain 4.5) 10.3 Cloud Application Architecture (Domain 4.6) 10.4 Identity & Access Management Solutions (Domain 4.7)
11 Domain 5: Build, Operate & Operational Controls
11.1 Build Physical & Logical Infrastructure (Domain 5.1) 11.2 Operate & Maintain Infrastructure (Domain 5.2) 11.3 Operational Controls & Standards (Domain 5.3)
12 Domain 5: Forensics, Stakeholder Communication & Security Operations
12.1 Digital Forensics Support (Domain 5.4) 12.2 Communication with Relevant Parties (Domain 5.5) 12.3 Manage Security Operations (Domain 5.6)
13 Domain 6: Legal Requirements, Privacy & Audit
13.1 Legal Requirements & Cloud Risks (Domain 6.1) 13.2 Privacy Requirements (Domain 6.2) 13.3 Audit Processes for Cloud (Domain 6.3)
14 Domain 6: Enterprise Risk Management & Cloud Contracts
14.1 Cloud Implications for Enterprise Risk (Domain 6.4) 14.2 Outsourcing & Cloud Contract Design (Domain 6.5)
7.2 Secure Data Center Design (Domain 3.2)
Key Takeaways Explain This Topic AI
Secure data center design spans logical design (tenant partitioning, access control), physical design (location, buy vs build), environmental design (HVAC, multi-vendor pathway connectivity), and design resilience (power, HVAC, connectivity).
Tenant partitioning and access control keep multi-tenant and multi-environment workloads isolated at network, identity, and resource-hierarchy layers.
Location and buy-versus-build decisions drive jurisdiction, latency, capital risk, and who owns facility security operations.
Environmental systems (cooling, diverse carrier pathways) are security-relevant because they underpin availability and incident response access.
Resilience design eliminates single points of failure across power, cooling, and connectivity — document N, N+1, 2N styles and test failover.
Last updated: July 2026
Secure Data Center Design
Domain 3.2 requires you to design a secure data center across four exam-listed dimensions:
- Logical design — tenant partitioning, access control
- Physical design — location, buy or build
- Environmental design — HVAC, multi-vendor pathway connectivity
- Design resilience — power, HVAC, connectivity
Even pure public-cloud customers benefit: you evaluate CSP regions and AZs through this lens, design hybrid colo correctly, and avoid false redundancy. Private cloud and enterprise platform teams apply the full checklist.
Secure design is proactive. Domain 3.4 (controls) and 3.5 (BC/DR) build on decisions made here. A poorly sited facility with a single power feed cannot be “patched” into high availability with software alone.
Design Goals
- Goal Meaning in data-center context
- Confidentiality Physical and logical barriers prevent unauthorized access to systems and media
- Integrity Change control for facility and fabric; tamper evidence; trusted supply chain
- Availability Redundant power, cooling, connectivity; maintainable without outage
- Safety Human life first — fire, egress, hazardous materials handling
- Compliance Jurisdictional fit, sector standards, audit evidence for visitors and media
- Efficiency Power Usage Effectiveness (PUE) and cost — green design can coexist with security
CCSP items may not use the word “CIA” explicitly; they describe a flood plain, a single ISP, or flat Layer-2 between tenants and ask for the best design correction.
Logical Design: Tenant Partitioning
Tenant partitioning is the set of logical boundaries that keep customers, business units, environments, or regulated workloads from interfering with or accessing each other. In a multi-tenant public cloud, the CSP implements hard tenant isolation. Inside your organization (or private cloud), you become the multi-tenant platform and must partition deliberately.
Partitioning layers
Layer Mechanisms Failure mode if weak
Account / subscription / project hierarchy Separate billing and policy roots per env or BU Blast radius of compromised org-admin
Network VPCs, VRFs, VLANs, non-overlapping CIDRs, no transitive peering by default Lateral movement across tenants
Identity Separate IdP apps/roles; SCIM boundaries; no shared local admin
Compute placement Dedicated hosts, node pools, taints/tolerations for sensitive workloads Co-residency with untrusted code
- Storage Separate accounts/buckets/encryption keys per tenant Cross-tenant read via mis-shared IAM
- Management plane Delegated admin scopes; deny standing global write One admin reconfigures all tenants
- Encryption keys Per-tenant CMKs / HSM partitions Crypto boundary collapse
- Partitioning patterns
Strong isolation (regulated): Separate accounts + separate networks + separate keys + dedicated admin roles; cross-tenant only via controlled APIs.
Soft multi-tenancy (internal PaaS): Shared platform, namespace/project isolation, strict RBAC and network policies — acceptable when threat model is employees/apps, not hostile external tenants, and residual risk is accepted.
Hybrid: Shared nonprod; hard split for production regulated data.
Exam tip: “Tenant partitioning” is not only VLAN IDs. If identity and management plane are shared with standing super-admin, network VLANs alone are theater.
Worked scenario: A private cloud hosts Hospital A and University B (community-style). Correct logical design uses separate virtual datacenters/accounts, non-routable defaults between them, distinct KMS keys, and separate admin groups. A shared “break-glass hypervisor admin” must be dual-controlled and fully logged — residual risk documented.
Logical Design: Access Control
Access control in data-center design covers both physical entry (who walks into the hall) and logical entry (who can touch systems and management interfaces). Domain 3.2 lists access control beside tenant partitioning because isolation without authorization still fails.
Physical access control (design phase)
- Control Design consideration
- Zoning Public lobby → security → staging → data halls → cages → racks
- Authentication factors Badge + PIN/biometric; no piggybacking (mantraps)
- Visitor management Escort, time-bound badges, inventory of devices
- Dual control Two-person rule for sensitive cages or media destruction rooms
- Logging & CCTV Coverage of entry points and sensitive aisles; retention aligned to policy
- Delivery Separate loading dock workflows; inspect packages
- Logical access control (design phase)
- Control Design consideration
- Privileged access workstations Admin only from hardened jump hosts / PAM
- Network path for management OOB management network; no management on user VLANs
- MFA & federation Strong auth for all facility IT and cloud admin paths
- Just-in-time elevation Standing permanent root minimized
- Remote hands procedures Documented, ticketed, dual authorization for colo remote hands
- Third-party access Vendors time-boxed; monitored sessions
Design rule: Management interfaces of hypervisors, storage arrays, BMS (building management systems), and PDU controllers are high-value. Putting BMS on the corporate internet without segmentation is a classic modern facility failure mode (availability and safety risk).
Access control design should specify who , from where , with what assurance , for how long , and with what audit trail — for both humans and automation.
Physical Design: Location
Location decisions influence natural disaster exposure, political and legal jurisdiction, latency to users, proximity to skilled staff, connectivity density, and utilities reliability.
Location factors checklist
Factor Questions
Geography & climate Flood plain, hurricane, wildfire, seismic, extreme heat?
Geopolitics & law Data residency, seizure risk, export controls, local LEA process?
Utilities Dual substations? Water for cooling? Grid stability?
Connectivity Carrier hotels nearby? Diverse long-haul fiber?
- Latency & market Distance to users and to paired DR site
- Physical security context Crime rates, stand-off distance, flight paths, adjacent hazards (chemical plants)
Staffing Can you hire and clear personnel?
Insurance & cost Premiums, land, taxes
Multi-site strategy: Primary and DR locations should avoid correlated risk — same flood basin, same power grid dependency, same single undersea cable landing if connectivity is critical. Public cloud “regions” and “availability zones” encode provider location strategy; customers still choose combinations that meet their correlation analysis.
Latency vs resilience trade-off: Synchronous replication wants short distance; disaster resilience wants long distance. Design explicitly: sync within metro/AZ sets; async across regions; document RPO impact (Domain 3.5 linkage).
Exam trap: Choosing a “cheap” site in a flood zone or stacking HA nodes in one building and calling it DR.
Physical Design: Buy or Build
Buy or build (sometimes lease colo vs construct owned facility vs consume public cloud regions) is a strategic design choice with security ownership implications.
Option Pros Cons / security notes
Build (own) Maximum control of physical and environmental design Capital intensive; you own full physical security ops and compliance evidence
Buy/lease colo Faster than greenfield; shared facility expertise Shared building risks; remote hands procedures; contract for cages, access, SLAs
Wholesale / dedicated data hall More control than retail colo Still dependent on landlord utilities and site security baseline
Public cloud regions No facility ops for customer; rich AZ design Less physical transparency; contractual/assurance-based trust; multi-tenant residual risk
Hybrid Place sensitive systems where control is highest Complexity of consistent policy and identity across sites
- Decision drivers for CCSP-style analysis
- Data sensitivity and regulatory need for physical control
- Capital vs operating expense
- Speed to market
- Skill availability for running facilities
- Exit and portability (reversibility from Domain 1)
- Concentration risk if “buy” means one landlord or one CSP
Security ownership shifts: Build → customer owns cameras, guards, generators. Colo → shared; contract must define access logs, visitor rules, and destruction of media. Public cloud → CSP owns facility; customer owns logical design inside the tenancy and selection of regions/AZs.
There is no universally “most secure” choice — only fit to risk appetite and capability . A poorly operated owned facility can be weaker than a top-tier colo or CSP region.
Environmental Design: HVAC
Heating, Ventilation, and Air Conditioning (HVAC) maintains temperature and humidity within equipment tolerances. Overheating causes shutdowns, throttling, and hardware failure — an availability incident that can look like a cyber attack to unprepared teams.
HVAC design considerations
- Topic Secure / resilient practice
- Capacity Size for peak IT load plus growth margin
- Redundancy N+1 or 2N CRACs/CRAHs, chillers, pumps as required by tier goals
- Airflow management Hot/cold aisle containment; blanking panels; avoid bypass airflow
- Monitoring Temperature/humidity sensors with alerting to ops and security ops
- Water risk Leak detection; routing of pipes away from critical rows where possible
- Maintenance Maintain cooling during maintenance windows via redundant units
- BMS security Segment building systems from corporate and production IT networks
- Emergency modes Economizers, free cooling, smoke mode procedures coordinated with fire systems
Environmental design intersects physical security: HVAC plant rooms need access control; outdoor cooling equipment may need anti-tamper and fencing. Climate change and extreme heat events increasingly drive location and HVAC capacity decisions — exam-relevant as availability risk analysis.
Link to logical ops: Thermal events should trigger incident procedures (migrate workloads, shed noncritical load) — not only facilities tickets.
Environmental Design: Multi-Vendor Pathway Connectivity
Multi-vendor pathway connectivity means communications enter and leave the facility over diverse physical paths and preferably diverse carriers , so a single fiber cut, provider outage, or conduit failure does not isolate the data center.
Diversity dimensions
- Dimension Good design False diversity
- Carrier Two or more independent providers Two contracts that share the same last-mile fiber
- Physical path Separate conduits, trenches, building entry points (A/B side) Two cables in one conduit
- Meet-me / POP Diverse upstream interconnection facilities Both circuits backhaul to one POP
- Equipment Redundant routers/firewalls in diverse racks/power Dual routers on one PDU
- Last mile Aerial vs underground mix when useful Single bridge or single manhole dependency
- Why this is “environmental” on the outline
Pathway design is part of how the building connects to the outside world — like power feeds and cooling water, it is facility-scale engineering. Security benefits:
- Availability under cable cuts and carrier failures
- Incident response — defenders retain access when one path is congested or attacked
- Reduced single-provider negotiation leverage (operational resilience)
Design validation: Request as-built conduit maps; perform failover tests; monitor both paths continuously (a dark diverse path that is never tested is not resilience). For cloud customers, multi-AZ and multi-region plus dual hybrid interconnects implement the same idea without owning fiber.
Exam stem pattern: “Two ISPs but both enter through the same building riser” → not true path diversity; remediate with second entry and separate internal distribution.
Design Resilience: Power, HVAC, Connectivity
Design resilience is the intentional elimination of single points of failure so the facility continues operating through component faults and planned maintenance. The outline singles out power , HVAC , and connectivity — the triad most often responsible for facility-level outages.
Power resilience
- Element Role
- Utility feeds Prefer dual feeds from separate substations when available
- UPS Bridge short outages and generator start; sized for load and runtime
- Generators Extended outage power; fuel contracts and testing critical
- PDUs / RPPs Distribute power; A/B power to racks for dual-corded equipment
Redundancy models N (no spare), N+1 (one spare), 2N (fully duplicated), 2N+1, etc.
Dual-corded servers on A and B feeds only help if A and B are truly independent through UPS/generator topology. Documentation and labeling prevent maintenance errors that take both sides down.
HVAC resilience
Mirror power thinking: redundant cooling units, diverse chillers, backup water sources if applicable, and the ability to cool during generator operation (generators produce heat and need their own environmental plan). Loss of cooling can force load shed faster than a brief power blip.
Connectivity resilience
Covered under multi-vendor pathways — plus internal spine/leaf or dual-core network designs, diverse DNS resolvers, and dual hybrid cloud interconnects. Resilience is end-to-end: diverse fiber into a single non-redundant firewall pair is still a SPOF.
Resilience design table
- Domain Minimum resilient idea Stronger pattern
- Power UPS + tested generator Dual utility + 2N UPS/generator paths + dual-corded IT
- HVAC N+1 CRACs Contained aisles + redundant chill water + leak detection
- Connectivity Two carriers Two carriers + two entry points + dual edge routers + tested failover
- People/process Runbooks Regular failover drills, fuel delivery drills, carrier SLA exercises
- Tiers and honesty
Industry tier/rating systems describe facility capability; they are not magic shields. CCSP cares that you match business RTO/RPO to facility capability and do not claim multi-site DR when both sites share one power grid disaster scenario.
Cloud customer translation
- Facility concept Cloud analogue
- Dual power to rack Multi-AZ deployments, provider SLA
- Diverse carriers Multi-homed hybrid links; multi-region API access
- Separate buildings Separate AZs/regions
- Buy/build Region selection + reserved capacity planning
- Putting Logical, Physical, Environmental, and Resilience Together
Secure data center design is a stack:
Choose location and buy/build model aligned to risk and law.
Engineer power, HVAC, connectivity for required resilience.
Implement physical access zones and secured BMS.
Implement tenant partitioning and logical access control so multi-tenant or multi-BU use does not collapse isolation.
Test — dark fiber, generator load bank, cooling failover, admin path revocation drills.
Common Traps
Paper diversity (two ISPs, one conduit).
HA clusters in one rack on one PDU called “resilient.”
Excellent cages but flat trust on the management network.
Building a facility without jurisdiction analysis for the data it will hold.