I have been getting more and more questions within the FSSP (ForeFront Security for SharePoint) space. If you are wondering about topology designs or where FSSP might live within a particular SharePoint configuration, please read the following and it will more than likely answer your question:
Using the Acceleration Toolkit for Microsoft Forefront Security for SharePoint
I wrote it to be pretty god damn exhaustive.
I get asked a lot about ForeFront topologies, meaning if you are given a SharePoint farm composed of X number of SharePoint components what machines get what. If you are interested in this, please look at my MSDN article:
Using the Acceleration Toolkit for Microsoft Forefront Security for SharePoint.
An acceleration toolkit provides a logical bundling of common documentation, proven server designs, and established research to assist in the accelerated implementation of options for a product. This Acceleration Toolkit for Microsoft Forefront Security for SharePoint (FSSP) targets an arbitrary SharePoint environment, regardless of deployment phase, to provide guidance for architects to rapidly supply full-fidelity FSSP enablement.