Study guide
3.4 Cloud Network Security Architecture
CompTIA Cloud+ Exam
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: Cloud Architecture Fundamentals
1.1 Cloud Service Models & Shared Responsibility 1.2 Cloud Deployment Models & Multi-Cloud Strategies 1.3 High Availability, Resiliency & Redundancy 1.4 Disaster Recovery & Business Continuity 1.5 Evolving Cloud Technologies: AI/ML Services, IoT & Edge Computing
2 Chapter 2: Cloud Compute & Storage Architecture
2.1 Virtualization & Hypervisor Architectures 2.2 Containerization & Microservices Architecture 2.3 Container Orchestration & Kubernetes Architecture 2.4 Cloud Storage Architectures & Performance
3 Chapter 3: Cloud Networking Architecture
3.1 Virtual Private Clouds & Subnetting Architecture 3.2 Hybrid & Multi-Cloud Connectivity 3.3 DNS, Load Balancing & Traffic Routing 3.4 Cloud Network Security Architecture
4 Chapter 4: Workload Assessment & Migration Planning
4.1 Cloud Migration Strategies (The 6/7 Rs) 4.2 Pre-Migration Workload Assessment & Sizing 4.3 Data & Database Migration Methods 4.4 Migration Execution, Cutover & Post-Migration Validation
5 Chapter 5: Infrastructure as Code & Provisioning
5.1 Infrastructure as Code Fundamentals & State Management 5.2 IaC Tooling & Template Authoring 5.3 Provisioning Automation & Image Management 5.4 Deployment Strategies & Release Patterns
6 Chapter 6: Cloud Operations & Lifecycle Management
6.1 Resource Lifecycle & Patch Management 6.2 Cloud Scaling Strategies & Elasticity 6.3 Cloud Cost Management & Optimization (FinOps) 6.4 Capacity Planning & Service Quotas
7 Chapter 7: Cloud Backup, Recovery & Business Continuity Operations
7.1 Backup Strategies, Storage Media & Retention Policies 7.2 Immutable Backups, Vault Locking & Ransomware Defense 7.3 Point-in-Time Recovery & Data Integrity Validation 7.4 High Availability Failover Drills & Chaos Engineering
8 Chapter 8: Cloud Security Controls & Identity and Access Management
8.1 Identity & Access Management, RBAC & ABAC 8.2 Identity Federation, SSO & Directory Integration 8.3 Multi-Factor Authentication, PAM & Machine Identities 8.4 Secrets Management & Cryptographic Credential Hygiene
9 Chapter 9: Data Protection, Vulnerability & Compliance
9.1 Data Encryption, Key Management & Confidential Computing 9.2 Vulnerability Management, Posture Assessment & CWPP 9.3 Container, Workload & Runtime Security 9.4 Cloud Compliance Frameworks & Governance Auditing
10 Chapter 10: DevOps Fundamentals & CI/CD Pipelines
10.1 Version Control Systems & Branching Strategies 10.2 Continuous Integration & Automated Testing Pipelines 10.3 Continuous Delivery, Deployment Automation & GitOps 10.4 Configuration Management & Systems Integration
11 Chapter 11: Cloud Observability & Monitoring
11.1 The Three Pillars of Observability: Metrics, Logs & Traces 11.2 Cloud Monitoring Architecture, Alerting & SLOs 11.3 Centralized Log Aggregation, SIEM & Log Analytics
12 Chapter 12: Troubleshooting Cloud Architecture & Deployments
12.1 Structured Cloud Troubleshooting Methodology 12.2 Troubleshooting Compute, Container & Storage Failures 12.3 Troubleshooting Provisioning, IaC & Automation Failures
13 Chapter 13: Troubleshooting Cloud Networking & Security
13.1 Troubleshooting Cloud Network Connectivity & Routing 13.2 Troubleshooting IAM, Permissions & Encryption 13.3 Troubleshooting Disaster Recovery & Performance Degradation
3.4 Cloud Network Security Architecture
Key Takeaways Explain This Topic AI
Security Groups provide stateful, instance/vNIC-level virtual firewalls that support allow-only rules and can reference other Security Groups by ID.
Network Access Control Lists (NACLs) provide stateless, subnet-level security enforcing numbered allow and deny rules in ascending order, requiring explicit ephemeral port rules for return traffic.
Cloud Next-Generation Firewalls (NGFW) and Firewall-as-a-Service (FWaaS) perform Deep Packet Inspection (DPI), Intrusion Prevention (IDS/IPS), and outbound FQDN domain filtering.
Web Application Firewalls (WAF) inspect Layer 7 HTTP/HTTPS traffic to block OWASP Top 10 vulnerabilities (SQLi, XSS), enforce rate limiting, and challenge malicious bots.
Zero Trust Network Access (ZTNA) and Micro-segmentation enforce least-privilege security on East-West internal traffic using service-to-service mutual TLS (mTLS) and identity-aware proxies.
Last updated: August 2026
Cloud Network Security Architecture
Cloud network security requires a layered Defense-in-Depth model spanning perimeter DDoS mitigation, Layer 7 Web Application Firewalls, Next-Generation Firewalls, stateless subnet filters, stateful instance firewalls, and cryptographic micro-segmentation. The CompTIA Cloud+ (CV0-004) exam heavily tests candidate knowledge regarding the exact boundaries, state tracking mechanics, and rule evaluations of each security layer.
1. Security Groups vs. Network Access Control Lists (NACLs)
The fundamental building blocks of VPC security are Security Groups and NACLs . Understanding their differences is among the most frequently tested concepts on the Cloud+ examination. +-----------------------------------------------------------------------------------------+
- | SECURITY GROUPS VS. NACLs ARCHITECTURE |
- | |
- | [ INCOMING PACKET FROM INTERNET / EXTERNAL ] |
- | | |
- | v |
- | +---------------------------------------------------------------------------------+ |
- | | NETWORK ACCESS CONTROL LIST (NACL) - Subnet Boundary | |
- | | - Stateless: Return traffic NOT tracked automatically | |
- | | - Evaluates Numbered Rules in Ascending Order (e.g., 100, 200, *) | |
- | | - Supports both ALLOW and DENY rules | |
- | +---------------------------------------------------------------------------------+ |
- | | |
- | | (If Inbound NACL Matches ALLOW) |
- | v |
- | +---------------------------------------------------------------------------------+ |
- | | SECURITY GROUP (SG) - Virtual Network Interface (vNIC) Level | |
- | | - Stateful: Return traffic automatically permitted regardless of outbound rules | |
- | | - Evaluates ALL rules before making an allow decision | |
- | | - Supports ALLOW rules only (Implicit Deny All) | |
- | +---------------------------------------------------------------------------------+ |
- | | |
- | v |
- | [ VIRTUAL MACHINE / CONTAINER INSTANCE ] |
- +-----------------------------------------------------------------------------------------+
- Comprehensive Comparison Matrix
- Architectural Attribute Security Groups (SG) Network Access Control Lists (NACL)
- Operational Scope Instance / Virtual Network Interface (vNIC) level Subnet boundary level
State Handling Stateful: Return traffic is automatically permitted regardless of outbound rules. Stateless: Return traffic must be explicitly permitted in both directions.
Rule Types Supported ALLOW rules only (Everything else is implicitly denied). ALLOW and DENY rules (Explicit blocklists supported).
Rule Evaluation Order Evaluates all rules before permitting traffic. Evaluates numbered rules in ascending numerical order (First match wins).
Default Rule (New) Inbound: Deny All. Outbound: Allow All. Inbound: Deny All. Outbound: Deny All (Custom NACL).
Default Rule (Default) Inbound: Allow intra-SG. Outbound: Allow All. Inbound: Allow All (Rule * Deny). Outbound: Allow All.
Ephemeral Port Impact Handled transparently by state connection tables in memory. Requires explicit outbound rules for ephemeral ports (1024–65535).
Rule Referencing Can reference other Security Groups by ID (e.g., sg-web ). Can only reference IP addresses and CIDR blocks.
The Ephemeral Port NACL Trap
When a client connects to a web server on port 443 (HTTPS), the client operating system allocates a random high-range source port known as an ephemeral port :
- Linux / Modern Windows / AWS NAT Gateway: 1024 to 65535
- Older Windows / Certain BSDs: 49152 to 65535
Because NACLs are stateless , when the web server sends the HTTP response back to the client, the outbound packet has a destination port in the ephemeral port range. If the subnet's outbound NACL does not have an explicit ALLOW rule for destination ports 1024–65535, all response traffic will be dropped at the subnet boundary , even though the inbound port 443 rule was matched.
2. Cloud Firewalls & Firewall-as-a-Service (FWaaS)
While Security Groups and NACLs provide basic Layer 3/4 filtering, modern cloud environments deploy Next-Generation Cloud Firewalls (e.g., AWS Network Firewall, Azure Firewall, GCP Cloud Firewall Plus, Palo Alto VM-Series): +-----------------------------------------------------------------------------------------+
- | NEXT-GENERATION CLOUD FIREWALL (NGFW) |
- | |
- | +---------------------------------------------------------------------------------+ |
- | | 1. Deep Packet Inspection (DPI): Analyzes application signatures inside payloads| |
- | | 2. Intrusion Detection & Prevention (IDS/IPS): Snort/Suricata signature engines | |
- | | 3. Outbound FQDN Filtering: Restricts egress to '*.github.com' / '*.docker.io' | |
- | | 4. TLS/SSL Decryption & Inspection: Intercepts encrypted C2 malware channels | |
- | +---------------------------------------------------------------------------------+ |
- +-----------------------------------------------------------------------------------------+
- Key Capabilities of FWaaS
Intrusion Detection and Prevention Systems (IDS/IPS): Inspects packet streams against thousands of known vulnerability signatures and zero-day threat heuristics, actively dropping malicious packets (IPS) or alerting SIEM systems (IDS).
Outbound Fully Qualified Domain Name (FQDN) Filtering: Prevents malware and compromised workloads from communicating with Command-and-Control (C2) servers or exfiltrating data, restricting egress to authorized wildcard domains (e.g., *.amazonaws.com , *.redhat.com ).
Centralized Firewall Management: Policy rule sets are managed centrally across hundreds of cloud accounts and VPCs using centralized governance tools (e.g., AWS Firewall Manager, Azure Firewall Manager).
3. Web Application Firewalls (WAF)
A Web Application Firewall (WAF) operates at Layer 7 (Application Layer) , deployed in front of Application Load Balancers, API Gateways, and CDN edge distributions.
OWASP Top 10 Threat Mitigation +-----------------------------------------------------------------------------------------+
- | WAF LAYER 7 MITIGATION MATRIX |
- | |
- | Threat / Vulnerability WAF Inspection & Defense Mechanism |
- | ---------------------------- --------------------------------------------------- |
- | SQL Injection (SQLi) Inspects URI, query strings, and POST body for SQL |
- | syntax tokens (' OR 1=1 --, UNION SELECT). |
- | |
- | Cross-Site Scripting (XSS) Filters malicious HTML/JavaScript tags (<script>, |
- | onerror=) injected into form fields and headers. |
- | |
- | HTTP Flood / Layer 7 DDoS Enforces Rate Limiting rules (e.g., block client IPs |
- | exceeding 2,000 requests per 5-minute window). |
- | |
- | Credential Stuffing / Bots Challenges automated headless browsers via CAPTCHA |
- | or JavaScript cryptographic proof-of-work tokens. |
- | |
- | Geographic IP Fencing Blocks or allows traffic based on ISO country codes. |
- +-----------------------------------------------------------------------------------------+
- 4. Micro-Segmentation & Zero Trust Network Access (ZTNA)
Traditional perimeter security operates on the flawed assumption that all traffic inside the internal network is trusted (North-South perimeter defense). Zero Trust Architecture (NIST SP 800-207) assumes the internal network is already compromised and enforces strict verification on all East-West (lateral) traffic . +-----------------------------------------------------------------------------------------+
- | PERIMETER DEFENSE VS. ZERO TRUST MICRO-SEGMENTATION |
- | |
- | LEGACY PERIMETER MODEL (Castle-and-Moat): |
- | - Strong perimeter firewall; internal East-West traffic completely uninspected. |
- | - Lateral movement risk: Compromising one web server compromises the entire VPC. |
- | |
- | ZERO TRUST / MICRO-SEGMENTATION MODEL: |
- | - Granular workload isolation at the container/pod/process level. |
- | - Workload Identity: Verified using SPIFFE/SPIRE cryptographic tokens. |
- | - Service-to-Service mTLS: All inter-service traffic encrypted and mutually authed. |
- | - Least-Privilege Policies: Auth Service CANNOT communicate with Billing DB directly. |
- +-----------------------------------------------------------------------------------------+
- Micro-Segmentation Implementation Techniques
Security Group Chaining: Application instances belong to sg-app , and Database instances belong to sg-db . The database security group allows inbound port 5432 only if the source is sg-app , automatically adapting as autoscaling groups add or remove app instances.
Kubernetes Network Policies (eBPF / CNI): Network plugins (e.g., Calico, Cilium) enforce micro-segmentation rules at the container kernel level using Linux eBPF (Extended Berkeley Packet Filter) , bypassing standard iptables overhead.
Mutual TLS (mTLS) with Service Meshes: Service meshes (e.g., Istio, Linkerd) inject sidecar proxies alongside application containers. Sidecars establish bidirectional mTLS encryption, authenticating both the client and server identities before transmitting application data.
Zero Trust Network Access (ZTNA) vs. Legacy VPNs: ZTNA replaces broad, full-network access VPN tunnels with identity-aware, application-specific proxies. Users are granted access strictly to authorized individual applications rather than the underlying network subnet.