Cloud Network Security and Segmentation
Domain 3: Cloud Network Security and Segmentation
This domain tests whether you can design east-west and north-south controls in virtual networks, and explain how cloud primitives differ from on-premises firewalls. Expect VPC/VNet design, security groups, network ACLs, private connectivity, and egress control.
Core rules
- Security groups are stateful, attached to resources, and allow rules only; network ACLs are stateless, subnet-level, and support allow and deny.
- Segment by tier and trust boundary: public ingress, application, data. Use private subnets for workloads that do not need inbound internet.
- Prefer private endpoints (AWS PrivateLink, Azure Private Link, GCP Private Service Connect) over public service endpoints.
- Control egress to prevent data exfiltration and command-and-control; use NAT gateways, firewalls, and DNS filtering.
- Hub-and-spoke or transit gateway designs centralize inspection, but watch asymmetric routing and cross-account exposure.
Worked example
A web tier must reach an object store. The team proposes a public bucket endpoint and a 0.0.0.0/0 egress rule. Better: keep the bucket private, create a VPC endpoint, attach an endpoint policy limited to the bucket ARN, and restrict the web tier's egress security group to the endpoint. Reasoning: traffic stays on the private network, the bucket is not public, and the endpoint policy adds a resource-level guard even if IAM is misconfigured.
Traps
- Opening database security groups to 0.0.0.0/0 because 'it is in a private subnet.'
- Forgetting NACL ephemeral port ranges for return traffic.
- Assuming a private subnet has no internet path; NAT or egress-only gateways may still exist.
- Treating WAF as a substitute for network segmentation.