I85PREP
⌘ K
CNEpv study materials
CNEpv study resources

CNEpv: Cloud, Virtualization, and Emerging Network Technologies

CNEpv · Work through your exam, one topic at a time.

All guide sections

Cloud, Virtualization, and Emerging Network Technologies

This domain tests how cloud and virtualization change network design, trust boundaries, and operations. Expect IaaS, PaaS, SaaS, VPC/VNet constructs, security groups versus NACLs, hybrid connectivity, SD-WAN, NFV, containers, and emerging access technologies.

Core rules

  • Cloud service models shift responsibility: IaaS gives virtual compute and network; PaaS manages the runtime; SaaS delivers the application. The provider secures the cloud, while the customer secures what they put in it.
  • A VPC or VNet is an isolated virtual network with subnets, route tables, and gateways. Security groups are stateful and allow-only; NACLs are stateless and support allow and deny rules.
  • VPC peering is not transitive. Overlapping CIDRs cannot peer directly; re-IP, use private NAT, or route through a transit design.
  • Hybrid links such as VPN, Direct Connect, and ExpressRoute provide private connectivity, but dedicated private circuits are not encrypted by default.
  • SD-WAN centralizes policy and uses multiple transports. NFV runs network functions as software. Containers share a host kernel; VMs run separate guest kernels under a hypervisor.
  • Zero trust, SASE, Wi-Fi 6/6E, 5G, and IoT edge extend identity-centric policy beyond the traditional campus.

Worked example

Two VPCs both use 10.0.0.0/16 and need to communicate. A peering request will fail or be unusable because the address space overlaps. The correct reasoning is to avoid ambiguity: re-address one VPC, use private NAT to translate overlapping ranges, or connect through a transit architecture that performs NAT. Adding a route table entry alone cannot fix duplicate prefixes, because the routers cannot distinguish the destinations.

Traps

Security groups are stateful; NACLs are stateless and need return traffic rules. VPC peering does not route through a third VPC. Direct Connect is private but not automatically encrypted. A Type 1 hypervisor runs on bare metal; Type 2 runs on a host OS. Containers are not lightweight VMs; they share the host kernel.