Cloud Security
What this domain tests
Cloud Security tests how you secure workloads and connectivity in public cloud and with cloud-delivered security. Expect Cisco Secure Firewall Threat Defense virtual (FTDv) insertion, AWS and Azure native controls, identity for workloads, and Umbrella Secure Internet Gateway.
Core rules
- AWS security groups are stateful and allow-only; NACLs are stateless and require both directions, including ephemeral ports 1024-65535.
- Azure NSGs are stateful and evaluated by priority; application security groups group NICs logically.
- Workload identity should use IAM roles or managed identities, not long-lived access keys.
- FTDv in AWS commonly sits behind a Gateway Load Balancer using Geneve encapsulation; traffic must remain symmetric to the same appliance.
- Transit Gateway route tables provide segmentation between VPCs; VPC peering does not support transitive routing.
- Umbrella SIG combines DNS-layer protection with proxy and CASB functions; CASB API mode sees SaaS data, inline proxy sees traffic.
Worked example
A web tier in VPC A must reach an RDS database in VPC B only through an FTDv in a security VPC. There is no direct peering.
Reasoning: attach all three VPCs to a Transit Gateway, create route tables so the web tier's route to the database points to the security VPC attachment, and the security VPC routes through the FTDv endpoint. On the database security group, permit only the FTDv interface security group as source, not the web tier CIDR. On the database NACL, allow the database port inbound and ephemeral ports outbound. Return traffic follows the same path because inspection requires symmetry. A common failure is permitting the web subnet in the database security group, which bypasses the firewall policy intent even though traffic still traverses the TGW.
Traps that cost marks
- Forgetting NACL ephemeral ports causes one-way connections.
- Overlapping CIDRs prevent peering and complicate TGW routing.
- Putting the FTDv management interface in the data path breaks inspection and management access.
- Security group references are more precise than CIDR rules and survive scaling.
- Auto-scaling firewalls need health checks and flow symmetry; otherwise sessions reset.
Key points
- Security groups are stateful; NACLs are stateless and need ephemeral ports.
- Use IAM roles or managed identities instead of embedded access keys.
- FTDv in AWS typically integrates through Gateway Load Balancer and Geneve.
- Transit Gateway route tables enforce VPC segmentation.
- Reference security groups as sources rather than broad CIDRs.
- Umbrella SIG combines DNS, proxy, and CASB controls.