Cloud Network Security and Segmentation
This domain tests whether you can design and verify network isolation in cloud environments, not just describe a firewall.
Core rules
- Start with deny-by-default and least exposure. Segment by account or VPC/VNet, subnet, and workload identity.
- Security groups are stateful and attached to resources; NACLs are stateless and evaluated at subnet boundaries. Use both deliberately.
- Keep management ports off the internet; use a bastion or session manager, private endpoints, and egress filtering.
- For hybrid and multi-cloud, control CIDR overlap, route tables, and transit hubs.
- Microsegmentation and zero trust replace flat networks; WAF and DDoS protection cover application edges.
Worked example
A three-tier web app has a public load balancer, private app servers, and a database subnet with no internet route. The web security group allows 443 from the internet; the app security group allows traffic only from the web security group; the database security group allows 5432 only from the app security group. Reasoning: referencing security groups instead of CIDRs keeps rules correct as scaling changes IPs, and the database has no direct path from the internet.
Traps
- Confusing security group and NACL behavior and evaluation order.
- Assuming a VPC alone segments workloads.
- Forgetting egress rules and private endpoint DNS.
- Overlapping CIDRs that break peering or hybrid routing.