3.4 Cloud Network Security Architecture
Key Takeaways
- Security Groups provide stateful, instance/vNIC-level virtual firewalls that support allow-only rules and can reference other Security Groups by ID.
- Network Access Control Lists (NACLs) provide stateless, subnet-level security enforcing numbered allow and deny rules in ascending order, requiring explicit ephemeral port rules for return traffic.
- Cloud Next-Generation Firewalls (NGFW) and Firewall-as-a-Service (FWaaS) perform Deep Packet Inspection (DPI), Intrusion Prevention (IDS/IPS), and outbound FQDN domain filtering.
- Web Application Firewalls (WAF) inspect Layer 7 HTTP/HTTPS traffic to block OWASP Top 10 vulnerabilities (SQLi, XSS), enforce rate limiting, and challenge malicious bots.
- Zero Trust Network Access (ZTNA) and Micro-segmentation enforce least-privilege security on East-West internal traffic using service-to-service mutual TLS (mTLS) and identity-aware proxies.
Cloud Network Security Architecture
Cloud network security requires a layered Defense-in-Depth model spanning perimeter DDoS mitigation, Layer 7 Web Application Firewalls, Next-Generation Firewalls, stateless subnet filters, stateful instance firewalls, and cryptographic micro-segmentation. The CompTIA Cloud+ (CV0-004) exam heavily tests candidate knowledge regarding the exact boundaries, state tracking mechanics, and rule evaluations of each security layer.
1. Security Groups vs. Network Access Control Lists (NACLs)
The fundamental building blocks of VPC security are Security Groups and NACLs. Understanding their differences is among the most frequently tested concepts on the Cloud+ examination.
+-----------------------------------------------------------------------------------------+
| SECURITY GROUPS VS. NACLs ARCHITECTURE |
| |
| [ INCOMING PACKET FROM INTERNET / EXTERNAL ] |
| | |
| v |
| +---------------------------------------------------------------------------------+ |
| | NETWORK ACCESS CONTROL LIST (NACL) - Subnet Boundary | |
| | - Stateless: Return traffic NOT tracked automatically | |
| | - Evaluates Numbered Rules in Ascending Order (e.g., 100, 200, *) | |
| | - Supports both ALLOW and DENY rules | |
| +---------------------------------------------------------------------------------+ |
| | |
| | (If Inbound NACL Matches ALLOW) |
| v |
| +---------------------------------------------------------------------------------+ |
| | SECURITY GROUP (SG) - Virtual Network Interface (vNIC) Level | |
| | - Stateful: Return traffic automatically permitted regardless of outbound rules | |
| | - Evaluates ALL rules before making an allow decision | |
| | - Supports ALLOW rules only (Implicit Deny All) | |
| +---------------------------------------------------------------------------------+ |
| | |
| v |
| [ VIRTUAL MACHINE / CONTAINER INSTANCE ] |
+-----------------------------------------------------------------------------------------+
Comprehensive Comparison Matrix
| Architectural Attribute | Security Groups (SG) | Network Access Control Lists (NACL) |
|---|---|---|
| Operational Scope | Instance / Virtual Network Interface (vNIC) level | Subnet boundary level |
| State Handling | Stateful: Return traffic is automatically permitted regardless of outbound rules. | Stateless: Return traffic must be explicitly permitted in both directions. |
| Rule Types Supported | ALLOW rules only (Everything else is implicitly denied). | ALLOW and DENY rules (Explicit blocklists supported). |
| Rule Evaluation Order | Evaluates all rules before permitting traffic. | Evaluates numbered rules in ascending numerical order (First match wins). |
| Default Rule (New) | Inbound: Deny All. Outbound: Allow All. | Inbound: Deny All. Outbound: Deny All (Custom NACL). |
| Default Rule (Default) | Inbound: Allow intra-SG. Outbound: Allow All. | Inbound: Allow All (Rule * Deny). Outbound: Allow All. |
| Ephemeral Port Impact | Handled transparently by state connection tables in memory. | Requires explicit outbound rules for ephemeral ports (1024–65535). |
| Rule Referencing | Can reference other Security Groups by ID (e.g., sg-web). | Can only reference IP addresses and CIDR blocks. |
The Ephemeral Port NACL Trap
When a client connects to a web server on port 443 (HTTPS), the client operating system allocates a random high-range source port known as an ephemeral port:
- Linux / Modern Windows / AWS NAT Gateway: 1024 to 65535
- Older Windows / Certain BSDs: 49152 to 65535
Because NACLs are stateless, when the web server sends the HTTP response back to the client, the outbound packet has a destination port in the ephemeral port range. If the subnet's outbound NACL does not have an explicit ALLOW rule for destination ports 1024–65535, all response traffic will be dropped at the subnet boundary, even though the inbound port 443 rule was matched.
2. Cloud Firewalls & Firewall-as-a-Service (FWaaS)
While Security Groups and NACLs provide basic Layer 3/4 filtering, modern cloud environments deploy Next-Generation Cloud Firewalls (e.g., AWS Network Firewall, Azure Firewall, GCP Cloud Firewall Plus, Palo Alto VM-Series):
+-----------------------------------------------------------------------------------------+
| NEXT-GENERATION CLOUD FIREWALL (NGFW) |
| |
| +---------------------------------------------------------------------------------+ |
| | 1. Deep Packet Inspection (DPI): Analyzes application signatures inside payloads| |
| | 2. Intrusion Detection & Prevention (IDS/IPS): Snort/Suricata signature engines | |
| | 3. Outbound FQDN Filtering: Restricts egress to '*.github.com' / '*.docker.io' | |
| | 4. TLS/SSL Decryption & Inspection: Intercepts encrypted C2 malware channels | |
| +---------------------------------------------------------------------------------+ |
+-----------------------------------------------------------------------------------------+
Key Capabilities of FWaaS
- Intrusion Detection and Prevention Systems (IDS/IPS): Inspects packet streams against thousands of known vulnerability signatures and zero-day threat heuristics, actively dropping malicious packets (IPS) or alerting SIEM systems (IDS).
- Outbound Fully Qualified Domain Name (FQDN) Filtering: Prevents malware and compromised workloads from communicating with Command-and-Control (C2) servers or exfiltrating data, restricting egress to authorized wildcard domains (e.g.,
*.amazonaws.com,*.redhat.com). - Centralized Firewall Management: Policy rule sets are managed centrally across hundreds of cloud accounts and VPCs using centralized governance tools (e.g., AWS Firewall Manager, Azure Firewall Manager).
3. Web Application Firewalls (WAF)
A Web Application Firewall (WAF) operates at Layer 7 (Application Layer), deployed in front of Application Load Balancers, API Gateways, and CDN edge distributions.
OWASP Top 10 Threat Mitigation
+-----------------------------------------------------------------------------------------+
| WAF LAYER 7 MITIGATION MATRIX |
| |
| Threat / Vulnerability WAF Inspection & Defense Mechanism |
| ---------------------------- --------------------------------------------------- |
| SQL Injection (SQLi) Inspects URI, query strings, and POST body for SQL |
| syntax tokens (' OR 1=1 --, UNION SELECT). |
| |
| Cross-Site Scripting (XSS) Filters malicious HTML/JavaScript tags (<script>, |
| onerror=) injected into form fields and headers. |
| |
| HTTP Flood / Layer 7 DDoS Enforces Rate Limiting rules (e.g., block client IPs |
| exceeding 2,000 requests per 5-minute window). |
| |
| Credential Stuffing / Bots Challenges automated headless browsers via CAPTCHA |
| or JavaScript cryptographic proof-of-work tokens. |
| |
| Geographic IP Fencing Blocks or allows traffic based on ISO country codes. |
+-----------------------------------------------------------------------------------------+
4. Micro-Segmentation & Zero Trust Network Access (ZTNA)
Traditional perimeter security operates on the flawed assumption that all traffic inside the internal network is trusted (North-South perimeter defense). Zero Trust Architecture (NIST SP 800-207) assumes the internal network is already compromised and enforces strict verification on all East-West (lateral) traffic.
+-----------------------------------------------------------------------------------------+
| PERIMETER DEFENSE VS. ZERO TRUST MICRO-SEGMENTATION |
| |
| LEGACY PERIMETER MODEL (Castle-and-Moat): |
| - Strong perimeter firewall; internal East-West traffic completely uninspected. |
| - Lateral movement risk: Compromising one web server compromises the entire VPC. |
| |
| ZERO TRUST / MICRO-SEGMENTATION MODEL: |
| - Granular workload isolation at the container/pod/process level. |
| - Workload Identity: Verified using SPIFFE/SPIRE cryptographic tokens. |
| - Service-to-Service mTLS: All inter-service traffic encrypted and mutually authed. |
| - Least-Privilege Policies: Auth Service CANNOT communicate with Billing DB directly. |
+-----------------------------------------------------------------------------------------+
Micro-Segmentation Implementation Techniques
- Security Group Chaining: Application instances belong to
sg-app, and Database instances belong tosg-db. The database security group allows inbound port 5432 only if the source issg-app, automatically adapting as autoscaling groups add or remove app instances. - Kubernetes Network Policies (eBPF / CNI): Network plugins (e.g., Calico, Cilium) enforce micro-segmentation rules at the container kernel level using Linux eBPF (Extended Berkeley Packet Filter), bypassing standard iptables overhead.
- Mutual TLS (mTLS) with Service Meshes: Service meshes (e.g., Istio, Linkerd) inject sidecar proxies alongside application containers. Sidecars establish bidirectional mTLS encryption, authenticating both the client and server identities before transmitting application data.
- Zero Trust Network Access (ZTNA) vs. Legacy VPNs: ZTNA replaces broad, full-network access VPN tunnels with identity-aware, application-specific proxies. Users are granted access strictly to authorized individual applications rather than the underlying network subnet.
A network security administrator configures a custom NACL on a public subnet housing web servers. The inbound NACL rule permits TCP traffic on port 443 from 0.0.0.0/0. However, when external clients send HTTPS requests, the connection times out. Inspection reveals the Security Group allows inbound 443 and outbound all traffic. What is the root cause of the connection failure?
An enterprise web application is experiencing distributed attacks where malicious actors inject SQL syntax tokens (' OR 1=1 --) into user login form fields to bypass authentication. Which security service should be deployed directly in front of the Application Load Balancer to inspect HTTP payloads and block these attacks?
In a Zero Trust cloud architecture, an administrator needs to prevent lateral movement (East-West traffic) between compromised containerized microservices within the same virtual network. Which combination of technologies enforces cryptographic identity and micro-segmentation between services?