7.2 Secure Data Center Design (Domain 3.2)

Secure Data Center Design

Domain 3.2 requires you to design a secure data center across four exam-listed dimensions:

1. Logical design — tenant partitioning, access control
2. Physical design — location, buy or build
3. Environmental design — HVAC, multi-vendor pathway connectivity
4. Design resilience — power, HVAC, connectivity

Even pure public-cloud customers benefit: you evaluate CSP regions and AZs through this lens, design hybrid colo correctly, and avoid false redundancy. Private cloud and enterprise platform teams apply the full checklist.

Secure design is proactive. Domain 3.4 (controls) and 3.5 (BC/DR) build on decisions made here. A poorly sited facility with a single power feed cannot be “patched” into high availability with software alone.

Design Goals

CCSP items may not use the word “CIA” explicitly; they describe a flood plain, a single ISP, or flat Layer-2 between tenants and ask for the best design correction.

Logical Design: Tenant Partitioning

Tenant partitioning is the set of logical boundaries that keep customers, business units, environments, or regulated workloads from interfering with or accessing each other. In a multi-tenant public cloud, the CSP implements hard tenant isolation. Inside your organization (or private cloud), you become the multi-tenant platform and must partition deliberately.

Partitioning layers

Partitioning patterns

1. Strong isolation (regulated): Separate accounts + separate networks + separate keys + dedicated admin roles; cross-tenant only via controlled APIs.
2. Soft multi-tenancy (internal PaaS): Shared platform, namespace/project isolation, strict RBAC and network policies — acceptable when threat model is employees/apps, not hostile external tenants, and residual risk is accepted.
3. Hybrid: Shared nonprod; hard split for production regulated data.

Exam tip: “Tenant partitioning” is not only VLAN IDs. If identity and management plane are shared with standing super-admin, network VLANs alone are theater.

Worked scenario: A private cloud hosts Hospital A and University B (community-style). Correct logical design uses separate virtual datacenters/accounts, non-routable defaults between them, distinct KMS keys, and separate admin groups. A shared “break-glass hypervisor admin” must be dual-controlled and fully logged — residual risk documented.

Logical Design: Access Control

Access control in data-center design covers both physical entry (who walks into the hall) and logical entry (who can touch systems and management interfaces). Domain 3.2 lists access control beside tenant partitioning because isolation without authorization still fails.

Physical access control (design phase)

Logical access control (design phase)

Design rule: Management interfaces of hypervisors, storage arrays, BMS (building management systems), and PDU controllers are high-value. Putting BMS on the corporate internet without segmentation is a classic modern facility failure mode (availability and safety risk).

Access control design should specify who, from where, with what assurance, for how long, and with what audit trail — for both humans and automation.

Physical Design: Location

Location decisions influence natural disaster exposure, political and legal jurisdiction, latency to users, proximity to skilled staff, connectivity density, and utilities reliability.

Location factors checklist

Multi-site strategy: Primary and DR locations should avoid correlated risk — same flood basin, same power grid dependency, same single undersea cable landing if connectivity is critical. Public cloud “regions” and “availability zones” encode provider location strategy; customers still choose combinations that meet their correlation analysis.

Latency vs resilience trade-off: Synchronous replication wants short distance; disaster resilience wants long distance. Design explicitly: sync within metro/AZ sets; async across regions; document RPO impact (Domain 3.5 linkage).

Exam trap: Choosing a “cheap” site in a flood zone or stacking HA nodes in one building and calling it DR.

Physical Design: Buy or Build

Buy or build (sometimes lease colo vs construct owned facility vs consume public cloud regions) is a strategic design choice with security ownership implications.

Decision drivers for CCSP-style analysis

• Data sensitivity and regulatory need for physical control
• Capital vs operating expense
• Speed to market
• Skill availability for running facilities
• Exit and portability (reversibility from Domain 1)
• Concentration risk if “buy” means one landlord or one CSP

Security ownership shifts: Build → customer owns cameras, guards, generators. Colo → shared; contract must define access logs, visitor rules, and destruction of media. Public cloud → CSP owns facility; customer owns logical design inside the tenancy and selection of regions/AZs.

There is no universally “most secure” choice — only fit to risk appetite and capability. A poorly operated owned facility can be weaker than a top-tier colo or CSP region.

Environmental Design: HVAC

Heating, Ventilation, and Air Conditioning (HVAC) maintains temperature and humidity within equipment tolerances. Overheating causes shutdowns, throttling, and hardware failure — an availability incident that can look like a cyber attack to unprepared teams.

HVAC design considerations

Environmental design intersects physical security: HVAC plant rooms need access control; outdoor cooling equipment may need anti-tamper and fencing. Climate change and extreme heat events increasingly drive location and HVAC capacity decisions — exam-relevant as availability risk analysis.

Link to logical ops: Thermal events should trigger incident procedures (migrate workloads, shed noncritical load) — not only facilities tickets.

Environmental Design: Multi-Vendor Pathway Connectivity

Multi-vendor pathway connectivity means communications enter and leave the facility over diverse physical paths and preferably diverse carriers, so a single fiber cut, provider outage, or conduit failure does not isolate the data center.

Diversity dimensions

Why this is “environmental” on the outline

Pathway design is part of how the building connects to the outside world — like power feeds and cooling water, it is facility-scale engineering. Security benefits:

• Availability under cable cuts and carrier failures
• Incident response — defenders retain access when one path is congested or attacked
• Reduced single-provider negotiation leverage (operational resilience)

Design validation: Request as-built conduit maps; perform failover tests; monitor both paths continuously (a dark diverse path that is never tested is not resilience). For cloud customers, multi-AZ and multi-region plus dual hybrid interconnects implement the same idea without owning fiber.

Exam stem pattern: “Two ISPs but both enter through the same building riser” → not true path diversity; remediate with second entry and separate internal distribution.

Design Resilience: Power, HVAC, Connectivity

Design resilience is the intentional elimination of single points of failure so the facility continues operating through component faults and planned maintenance. The outline singles out power, HVAC, and connectivity — the triad most often responsible for facility-level outages.

Power resilience

Dual-corded servers on A and B feeds only help if A and B are truly independent through UPS/generator topology. Documentation and labeling prevent maintenance errors that take both sides down.

HVAC resilience

Mirror power thinking: redundant cooling units, diverse chillers, backup water sources if applicable, and the ability to cool during generator operation (generators produce heat and need their own environmental plan). Loss of cooling can force load shed faster than a brief power blip.

Connectivity resilience

Covered under multi-vendor pathways — plus internal spine/leaf or dual-core network designs, diverse DNS resolvers, and dual hybrid cloud interconnects. Resilience is end-to-end: diverse fiber into a single non-redundant firewall pair is still a SPOF.

Resilience design table

Tiers and honesty

Industry tier/rating systems describe facility capability; they are not magic shields. CCSP cares that you match business RTO/RPO to facility capability and do not claim multi-site DR when both sites share one power grid disaster scenario.

Cloud customer translation

Putting Logical, Physical, Environmental, and Resilience Together

Secure data center design is a stack:

1. Choose location and buy/build model aligned to risk and law.
2. Engineer power, HVAC, connectivity for required resilience.
3. Implement physical access zones and secured BMS.
4. Implement tenant partitioning and logical access control so multi-tenant or multi-BU use does not collapse isolation.
5. Test — dark fiber, generator load bank, cooling failover, admin path revocation drills.

Common Traps

• Paper diversity (two ISPs, one conduit).
• HA clusters in one rack on one PDU called “resilient.”
• Excellent cages but flat trust on the management network.
• Building a facility without jurisdiction analysis for the data it will hold.
• Never testing failover because “redundancy is configured.”