Cloud Network Security and Visibility
This domain tests how you see and constrain traffic in cloud networks, and how you turn native flow and DNS telemetry into detection. Expect questions about which log source proves a claim, and about the semantics of cloud firewall constructs.
Where visibility comes from
- Flow logs (VPC Flow Logs, NSG flow logs, VPC flow logs in GCP) record accepted and rejected connections with metadata - source, destination, port, bytes, action - but never payload or process. They answer "did this host talk to that IP?"
- DNS logs (for example Route 53 Resolver logs) reveal resolution attempts, useful for command-and-control and tunnelling detection.
- Control-plane logs (CloudTrail, Activity Log, Audit Logs) show security group and route table changes - the cause of a visibility gap.
- Sensor network telemetry adds process-to-connection attribution that flow logs cannot provide.
Segmentation constructs and their semantics
Security groups are stateful and allow-only; there is no deny rule, so restrictive logic must come from elsewhere (network ACLs, which are stateless and evaluated in order, or provider policy). Private subnets have no direct internet route but may still egress through a NAT gateway - "private" is not "isolated". Private endpoints (PrivateLink, Private Endpoint, Private Service Connect) keep service traffic off the internet entirely. Hybrid links (VPN, Direct Connect, ExpressRoute, Interconnect) extend the trust boundary into the cloud VPC.
Exposure management
Internet-exposed management ports, public storage endpoints and unrestricted ingress on 0.0.0.0/0 are the recurring findings. Combine posture findings with observed inbound traffic to separate theoretical exposure from actively probed exposure.
Worked example
A security group allows 0.0.0.0/0 to TCP 3389 on a production subnet. Reasoning: posture management flags the misconfiguration as an indicator of misconfiguration; flow logs confirm repeated rejected and accepted inbound attempts from scanning addresses, proving active probing; the remediation is to remove the rule (or scope to a bastion or session-manager path) and verify no dependent automation breaks. A NACL deny would be defence in depth, not the primary fix, because the security group is the intended control point.
Traps that cost marks
Assuming flow logs contain payload or process names; writing a "deny" into a security group; equating a private subnet with no egress; ignoring route table and peering changes that silently widen reachability; treating encryption in transit as default on internal paths.