I85PREP
⌘ K
CSPCC study materials
CSPCC study resources

CSPCC: Cloud Infrastructure and Network Security

CSPCC · Work through your exam, one topic at a time.

All guide sections

Cloud Infrastructure and Network Security

What this domain tests

Cloud Infrastructure and Network Security tests segmentation, traffic control, hybrid connectivity, and protection of management planes. You must design VPC/VNet layouts, choose security groups versus network ACLs, and secure ingress, egress, and administrative access.

Core rules and concepts

  • Segment by tier and trust: public ingress, application, data, and management. Use private subnets for workloads that do not need direct internet exposure.
  • Security groups are stateful, instance or ENI-level allow lists. Network ACLs are stateless, subnet-level, and evaluate ordered allow/deny rules; return traffic must be explicitly allowed.
  • Control egress, not just ingress. Use NAT gateways, egress firewalls, DNS filtering, and private endpoints to reduce data exfiltration and shadow IT.
  • Hybrid links (VPN, dedicated interconnect) need routing, encryption, redundancy, and boundary inspection. Do not assume private connectivity is automatically trusted.
  • Protect management planes with bastion or session-manager patterns, MFA, just-in-time access, and logging. WAF, DDoS protection, and load balancers belong in front of public web services.

Worked example

A three-tier web app needs public HTTPS but no database internet access. Place the load balancer in a public subnet, app servers in a private subnet, and databases in an isolated data subnet. Allow 443 from the internet to the load balancer only; allow app-tier security group to reach the database port; allow app egress to package repositories through a controlled NAT or proxy. Enable flow logs and WAF. The reasoning is defense in depth: each control enforces a different boundary, and the database has no route to the internet.

Traps that cost marks

  • Opening 0.0.0.0/0 to SSH or database ports.
  • Treating security groups as stateless or NACLs as stateful.
  • Using the default VPC and default security group for production.
  • Forgetting east-west traffic and egress filtering.
  • Assuming a private circuit bypasses encryption or inspection needs.