Module Navigation

Previous: Key Management QA | Parent: Security Learning Path | Next: Secrets Management QA

---

Introduction

Network Security is the practice of protecting cloud networks, workloads, applications, and data from unauthorized access, cyberattacks, and data breaches. It uses multiple security controls such as firewalls, network segmentation, encryption, VPNs, intrusion detection systems, and Web Application Firewalls (WAF) to secure communication.

Unlike traditional data centers, cloud environments are dynamic and highly distributed, making network security one of the most critical aspects of cloud architecture.

---

Why Network Security Matters

Network Security helps organizations:

• Prevent unauthorized access
• Protect sensitive customer data
• Secure APIs and microservices
• Prevent Distributed Denial of Service (DDoS) attacks
• Reduce attack surfaces
• Meet compliance requirements
• Secure hybrid and multi-cloud environments

---

Cloud Network Security Architecture

flowchart LR

Internet --> CloudFirewall
CloudFirewall --> WAF
WAF --> LoadBalancer
LoadBalancer --> PublicSubnet

PublicSubnet --> AppServer

AppServer --> PrivateSubnet

PrivateSubnet --> Database

Database --> BackupStorage

AppServer --> Monitoring

---

Defense in Depth

Cloud network security follows multiple layers of protection.

flowchart TD

User

Firewall

WAF

LoadBalancer

Application

Database

Encryption

Monitoring

User --> Firewall
Firewall --> WAF
WAF --> LoadBalancer
LoadBalancer --> Application
Application --> Database
Database --> Encryption
Encryption --> Monitoring

Each layer protects the next, reducing the impact of a successful attack.

---

Common Network Security Components

Component	Purpose
VPC/VNet	Isolated cloud network
Subnet	Network segmentation
Security Groups	Instance-level firewall
Network ACL	Subnet-level firewall
Firewall	Filters network traffic
WAF	Protects web applications
VPN	Secure private connectivity
IDS	Detects attacks
IPS	Prevents attacks
Bastion Host	Secure administrative access
Load Balancer	Secure traffic distribution
TLS	Encrypts communication

---

Public vs Private Subnet

Public Subnet	Private Subnet
Internet accessible	No direct internet access
Load Balancers	Databases
NAT Gateway	Internal services
Bastion Host	Microservices
Web Servers	Sensitive workloads

Production systems should place databases and internal services in private subnets.

---

Security Groups vs Network ACL

Security Group	Network ACL
Instance level	Subnet level
Stateful	Stateless
Allow rules only	Allow and Deny rules
Easier to manage	Fine-grained subnet control

---

Interview Questions

---

1. What is Network Security?

Answer

Network Security protects cloud infrastructure and applications from unauthorized access, attacks, and data breaches using security controls such as firewalls, network segmentation, encryption, VPNs, IDS/IPS, and monitoring.

Its primary objectives are:

• Confidentiality
• Integrity
• Availability

---

2. What is a Virtual Private Cloud (VPC)?

Answer

A Virtual Private Cloud (VPC) is an isolated virtual network within a cloud provider.

Features include:

• Private IP addressing
• Subnets
• Route tables
• Internet Gateway
• NAT Gateway
• Security Groups
• Network ACLs

A VPC provides complete control over network architecture and security.

---

3. What is the difference between Security Groups and Network ACLs?

Answer

Security Groups

• Applied to instances
• Stateful
• Only Allow rules
• Automatically allows return traffic

Network ACLs

• Applied to subnets
• Stateless
• Supports Allow and Deny rules
• Return traffic must be explicitly allowed

Security Groups protect workloads, while Network ACLs provide subnet-level protection.

---

4. What is a Web Application Firewall (WAF)?

Answer

A WAF protects web applications by filtering HTTP and HTTPS requests.

It protects against:

• SQL Injection
• Cross-Site Scripting (XSS)
• Command Injection
• Bot attacks
• OWASP Top 10 threats

AWS WAF, Azure Web Application Firewall, and Google Cloud Armor are common managed services.

---

5. What is the difference between a Firewall and a WAF?

Answer

Firewall	WAF
Protects network traffic	Protects web applications
Works at Network Layer	Works at HTTP/HTTPS Layer
Blocks IPs and Ports	Blocks malicious web requests

Both should be used together for layered security.

---

6. What is a VPN?

Answer

A Virtual Private Network (VPN) creates an encrypted tunnel between two networks or between a user and the cloud.

Common use cases:

• Hybrid cloud
• Remote employees
• Site-to-site connectivity
• Secure administration

VPNs protect traffic using protocols such as IPsec.

---

7. What is Network Segmentation?

Answer

Network Segmentation divides a network into smaller isolated sections to reduce attack surfaces.

Example:

• Public subnet for web servers
• Private subnet for application servers
• Separate subnet for databases

Benefits:

• Better security
• Easier compliance
• Reduced lateral movement during attacks

---

8. How is Network Security implemented in production?

Answer

A banking application typically includes:

• Private VPC
• Public and private subnets
• Security Groups
• Network ACLs
• AWS WAF
• AWS Shield
• VPN or Direct Connect
• IAM
• TLS encryption
• Cloud monitoring
• Intrusion detection

This layered approach significantly improves overall security.

---

9. What are common network attacks?

Answer

Common attacks include:

• DDoS
• SQL Injection
• Cross-Site Scripting (XSS)
• Port Scanning
• Man-in-the-Middle (MITM)
• DNS Spoofing
• Brute Force attacks
• Credential theft
• Packet sniffing

Proper network security controls reduce these risks.

---

10. What are Network Security best practices?

Answer

• Use private subnets for databases.
• Apply the Principle of Least Privilege.
• Restrict inbound ports.
• Enable HTTPS everywhere.
• Use managed WAF services.
• Enable DDoS protection.
• Use VPN or private connectivity.
• Monitor logs continuously.
• Perform regular vulnerability assessments.
• Patch operating systems promptly.

---

Production Architecture

flowchart LR

Users --> Internet

Internet --> WAF

WAF --> LoadBalancer

LoadBalancer --> PublicSubnet

PublicSubnet --> App1

PublicSubnet --> App2

App1 --> PrivateSubnet

App2 --> PrivateSubnet

PrivateSubnet --> Database

Database --> Backup

App1 --> CloudWatch

App2 --> CloudWatch

---

AWS, Azure and GCP Network Security Services

AWS	Azure	Google Cloud
VPC	Virtual Network	VPC
Security Groups	Network Security Groups	Firewall Rules
Network ACL	Azure Firewall	VPC Firewall
AWS WAF	Azure WAF	Cloud Armor
Shield	DDoS Protection	Cloud Armor DDoS
VPN Gateway	VPN Gateway	Cloud VPN
Transit Gateway	Virtual WAN	Network Connectivity Center

---

Common Interview Follow-up Questions

• What is Zero Trust Networking?
• Difference between Security Groups and Firewalls?
• Explain Stateful vs Stateless firewalls.
• What is AWS Shield?
• What is Cloud Armor?
• Explain Bastion Hosts.
• Difference between Internet Gateway and NAT Gateway.
• How do you secure Kubernetes networking?
• What is PrivateLink?
• How do you troubleshoot network connectivity issues?

---

Common Mistakes

• Opening SSH (22) to the entire internet.
• Opening database ports publicly.
• Using overly permissive Security Groups.
• Ignoring Network ACL rules.
• Not enabling HTTPS.
• Deploying databases in public subnets.
• Missing DDoS protection.
• No centralized monitoring.
• Weak VPN authentication.
• Lack of network segmentation.

---

Best Practices

• Use layered security (Defense in Depth).
• Place databases in private subnets.
• Use least-privilege firewall rules.
• Encrypt all network traffic using TLS.
• Deploy WAF in front of public applications.
• Enable DDoS protection.
• Regularly review firewall rules.
• Monitor network traffic continuously.
• Implement Zero Trust principles.
• Perform periodic penetration testing.

---

Quick Revision

Topic	Key Point
VPC	Private cloud network
Subnet	Network segmentation
Security Group	Stateful instance firewall
Network ACL	Stateless subnet firewall
WAF	Web application protection
Firewall	Network traffic filtering
VPN	Secure encrypted connectivity
IDS/IPS	Detects and prevents attacks
TLS	Encrypts network traffic
Zero Trust	Never trust, always verify

---

Key Takeaways

• Network Security is a foundational layer of cloud security that protects applications, infrastructure, and data.
• Defense in Depth combines multiple controls such as Security Groups, Network ACLs, WAFs, VPNs, and monitoring.
• Public-facing resources should be isolated from sensitive workloads using network segmentation.
• Managed services from AWS, Azure, and GCP simplify implementing secure cloud networks.
• A secure cloud architecture always follows least privilege, encryption, continuous monitoring, and Zero Trust principles.

---