4.2 - Cloud network and data protection
Cloud+ CV0-004 objective 4.2 covers protecting cloud networks and data. A security group is a stateful, instance-level virtual firewall that controls traffic to a cloud VM, allowing return traffic automatically, unlike stateless network ACLs at the subnet level. Segmentation divides a network into isolated zones so a breach in one zone cannot spread to others, and micro-segmentation takes this down to individual workloads. Encryption protects data by state: encrypting data as it crosses the network with TLS provides protection in transit, while encryption at rest protects stored data on disks and volumes. You should also know key management, VPNs, private endpoints and firewalls. Expect scenario questions that describe an instance-level firewall, isolating zones to contain a breach, or protecting data on the wire versus on disk, and ask which control - security group, segmentation or in-transit encryption - applies.
Stateful instance-level virtual firewall = security group. Isolated zones to contain a breach = segmentation (per-workload = micro-segmentation). TLS on the network = encryption in transit; encrypted disks/volumes = at rest.
Practice questions
1. A stateful, instance-level virtual firewall that controls traffic to a cloud VM is a:
- Network ACL
- Security group (correct answer)
- Route table
- IAM policy
A security group is a stateful firewall attached to instances (return traffic auto-allowed). A network ACL is stateless and works at the subnet level.
2. A model that trusts no request by default and verifies every access, inside or outside the network, is:
- Least privilege
- Zero trust (correct answer)
- Implicit allow
- Perimeter security
Zero trust removes implicit network trust: every request is authenticated, authorized and continuously verified. Perimeter security wrongly trusts anything inside.
3. Which control is stateless, evaluates ordered allow and deny rules, and acts at the subnet boundary?
- Network ACL (correct answer)
- Security group
- IAM role
- KMS key
A network ACL is a stateless, ordered allow/deny filter at the subnet edge; it evaluates rules by number and does not track connection state. Security groups are stateful per instance.
4. A filter that inspects HTTP requests to block SQL injection and cross-site scripting is a:
- Layer 4 load balancer
- Bastion jump host
- Web application firewall (correct answer)
- Subnet network ACL
A WAF inspects Layer 7 HTTP traffic and blocks web attacks like SQLi and XSS using rule sets. A network ACL only filters by IP, port and protocol at the subnet.
5. Encrypting data as it crosses the network with TLS provides protection:
- At rest
- In transit (correct answer)
- In use
- In backup
TLS provides encryption in transit, protecting data moving over the network from eavesdropping and tampering. Encryption at rest instead protects stored data on disks and buckets.
6. Which pair correctly matches a control to its scope: security group and network ACL?
- SG per instance; NACL per subnet (correct answer)
- SG per subnet; NACL per instance
- Both per instance only
- Both per subnet only
A security group is stateful and applies at the instance level, while a network ACL is stateless and applies at the subnet level. Swapping their scopes is a common exam trap.