Networking and Traffic Management
What the exam tests
This domain tests how traffic enters, moves, and fails over in IBM Cloud. Expect VPC load balancers, security groups, network ACLs, public and private gateways, DNS, IBM Cloud Internet Services global load balancing, health checks, Direct Link, Transit Gateway, and flow logs.
Core rules
- A VPC application load balancer handles HTTP/HTTPS and supports layer-7 health checks; a network load balancer handles TCP/UDP at layer 4. Health checks must test a path that reflects real application health.
- IBM Cloud Internet Services provides DNS, global load balancing, WAF, and DDoS protection. Global load balancer pools use origins and health checks to fail over between regions.
- Direct Link provides dedicated connectivity; Transit Gateway connects VPCs and Classic Infrastructure. Plan CIDRs so they do not overlap.
- Security groups are stateful and attached to interfaces. Network ACLs are stateless and attached to subnets, so return traffic rules must be explicit.
- Use public gateways for outbound internet access and private service endpoints where supported to avoid public exposure.
- DNS failover is not instantaneous. Keep TTLs appropriate for recovery objectives and design applications to be stateless so new connections can move.
Worked example. Users reach app.example.com through a CIS global load balancer. The primary pool is a Dallas application load balancer; the secondary pool is London. The health check calls /health every 30 seconds and fails after two failures. When Dallas fails, CIS returns London answers to new DNS resolutions. Existing connections continue until TTL expiry, so the team uses a 60-second TTL and keeps sessions in a shared store. Reasoning: DNS-based failover depends on health-check accuracy and TTL; sticky local sessions would break after failover.
Traps that cost marks
A /health endpoint that returns 200 from a static page while dependencies are down; very high DNS TTLs; overlapping VPC CIDRs that block Transit Gateway; forgetting stateless ACL return rules; using security groups as if they were subnet ACLs; no flow logs when debugging rejected traffic.
Key points
- ALB is layer 7; NLB is layer 4; health checks must reflect real health.
- CIS global load balancing uses pools, origins, and health checks.
- Direct Link is dedicated connectivity; Transit Gateway connects networks.
- Security groups are stateful; ACLs are stateless.
- DNS failover is bounded by TTL and client behavior.