I85PREP
⌘ K
FCSS Public Cloud Security study materials
FCSS Public Cloud Security study resources

FCSS Public Cloud Security: Cloud Network Security Architecture (VPC/VNet, Segmentation, Routing)

FCSS Public Cloud Security · Work through your exam, one topic at a time.

All guide sections

Cloud Network Security Architecture (VPC/VNet, Segmentation, Routing)

The second domain tests design decisions: address plans, subnet tiers, route tables, stateful versus stateless filters, and how a FortiGate is inserted without breaking return paths. Questions often use AWS VPC, Azure VNet, or GCP VPC terminology interchangeably but expect cloud-specific route behavior.

Core rules

  • Cloud route tables choose the next hop; the most specific prefix wins. Security groups/NSGs are stateful allow-lists; NACLs are stateless and need both request and ephemeral-port rules.
  • Segmentation starts with non-overlapping CIDRs. Overlapping ranges block VPC/VNet peering and complicate transit. Use hub-and-spoke or a transit gateway for many spokes.
  • Inspection is inserted with a gateway load balancer (AWS GWLB, Azure Gateway Load Balancer) or by routing to a FortiGate ENI/NIC. The appliance needs a route back to the source, and the source needs a route to the appliance.
  • VPC/VNet peering is non-transitive. Spoke-to-spoke traffic through a hub must be routed explicitly, often with a FortiGate as the hub security VPC.
  • Gateway endpoints and private endpoints can bypass inspection; decide whether that is an accepted path or must be blocked.

Worked example

VPC A (10.0.0.0/16) and VPC B (10.1.0.0/16) connect through a transit gateway to a security VPC containing a FortiGate. For east-west inspection, attach A and B to the TGW, put a TGW route table entry for 10.0.0.0/16 and 10.1.0.0/16 pointing to the FortiGate attachment, and give the FortiGate a route for both prefixes back through the TGW. Security groups on the FortiGate ENI must allow the workload ports, and the FortiGate policy must permit A-to-B. If either return route is missing, the flow is asymmetric or dropped. Test with a specific source/destination pair, not just ping.

Traps

  • Forgetting ephemeral return ports on NACLs.
  • Assuming peering is transitive.
  • Creating a route to the FortiGate but no route from it.
  • Overlapping CIDRs that cannot be peered.
  • Letting endpoint traffic bypass inspection unintentionally.
  • Ignoring Azure IP forwarding on the appliance NIC or AWS source/destination check.