Cloud Architecture — CompTIA Cloud (CV0-004) GED Study Notes

Chapter 1

Cloud Architecture

Course: Comptia Cloud Cv0 004
Subject: Comptia Cloud Cv0004
Chapter: Cloud Architecture

1. Public and Private Connections to the Cloud

Organizations can access cloud resources via public or private connectivity options, each with trade-offs in terms of performance, security, cost, and complexity. Choosing the right method depends on the organization’s use case, compliance requirements, and technical needs.

A. Virtual Private Network (VPN)

Definition

A Virtual Private Network (VPN) is a secure, encrypted communication tunnel over the public internet that allows private traffic between an enterprise network or individual endpoint and a cloud environment, such as AWS VPC, Azure Virtual Network (VNet), or GCP VPC.

Purpose

Ensures data confidentiality and integrity across untrusted public networks (e.g., the internet).
Enables secure access to cloud-hosted services (IaaS, SaaS, PaaS) without exposing them directly to the internet.
Commonly used as a cost-effective and quick way to extend private networks into the cloud.

Types of VPN

Site-to-Site VPN

Typically used to integrate on-premises data centers with a cloud provider.
VPN tunnels are established between network gateways (e.g., Cisco ASA, AWS VGW).
Supported by cloud platforms such as:

AWS VPN Gateway

Azure VPN Gateway

GCP Cloud VPN

AWS VPN Gateway
Azure VPN Gateway
GCP Cloud VPN

Client-to-Site VPN

Uses VPN client software (e.g., OpenVPN, Cisco AnyConnect, AWS Client VPN) on end-user devices.
Authentication can be integrated with Identity Providers (IdPs) via SAML, RADIUS, or LDAP.
Fine-grained access control can be enforced via network policies and security groups.

Protocols Used

| Protocol | Description | | IPsec | Internet Protocol Security: Uses ESP (Encapsulating Security Payload) and IKE for encryption and key exchange. | | SSL/TLS | Secure Sockets Layer / Transport Layer Security: Often used for client-based VPNs over TCP/443, easier to traverse firewalls. |

Real-World Use Case

Scenario: A multinational corporation with a headquarters in New York and a cloud infrastructure in AWS US-East-1.

Uses Site-to-Site IPsec VPN to connect the on-premises network with the AWS VPC.

Internal applications like Active Directory, Oracle DB, and internal APIs are accessible securely via private IPs.

Secondary Client-to-Site VPN is used for remote employees and incident response teams.

Limitations of VPNs

| Limitation | Explanation | | Performance Bottlenecks | Performance is dependent on internet bandwidth and quality. Congestion, packet loss, and jitter can affect app performance. | | Higher Latency | Public internet introduces unpredictable latency and routing. | | Scalability Challenges | Managing large numbers of client VPN connections may require complex configuration and monitoring. | | Single Point of Failure | Unless VPN endpoints are made redundant, a gateway failure may impact connectivity. |

B. Dedicated Connections (Private Network Links)

Definition

A dedicated connection is a private, physical link between an organization’s on-premises infrastructure and the cloud provider’s backbone network. These links bypass the public internet, delivering enterprise-grade performance and security.

Major Providers and Offerings

Benefits of Dedicated Connections

| Benefit | Description | | Lower Latency | Traffic takes the most direct path into the cloud provider’s network, reducing hops. | | Consistent Performance | Guaranteed bandwidth options (e.g., 1 Gbps, 10 Gbps, 100 Gbps); avoids internet congestion. | | Enhanced Security | Traffic does not traverse the internet—mitigates risk of interception or spoofing. | | Compliance-Ready | Satisfies regulations like PCI-DSS, HIPAA, and SOX that prohibit sensitive data over public internet. |

Real-World Use Case

Scenario: A financial institution requires high-throughput, low-latency, and compliant connectivity between its data center and AWS for running high-frequency trading (HFT) applications.

Implements AWS Direct Connect with redundant 10 Gbps links at an AWS Direct Connect location via an MPLS provider.

Routes all sensitive workloads through this connection, while non-critical workloads use standard Site-to-Site VPN.

Ensures compliance with FINRA and SOX by not using the public internet for customer data or trading signals.

Technical Details

Provisioning:

Done via a telecom carrier or cloud exchange provider (e.g., Equinix, Megaport).

Connection can be layer 2 (VLAN-based) or layer 3 (BGP-based).

Done via a telecom carrier or cloud exchange provider (e.g., Equinix, Megaport).
Connection can be layer 2 (VLAN-based) or layer 3 (BGP-based).
Redundancy:

Best practices include deploying dual connections in different physical locations for failover.

BGP can be used to manage route failover between private and public paths.

Best practices include deploying dual connections in different physical locations for failover.
BGP can be used to manage route failover between private and public paths.
Multiprotocol Label Switching (MPLS):

Supported in many deployments; allows advanced traffic engineering and QoS features.

Carriers often provide QoS SLAs for mission-critical applications.

Supported in many deployments; allows advanced traffic engineering and QoS features.
Carriers often provide QoS SLAs for mission-critical applications.

Comparison: VPN vs Dedicated Connections

Conclusion

Organizations must align their cloud connectivity strategy with their operational, security, and compliance goals. While VPNs offer cost-effective and flexible access methods, they may not suffice for latency-sensitive or regulated applications. Dedicated connections provide the reliability and security needed for enterprise-grade workloads, but at the cost of higher complexity and investment. Hybrid models often combine both for optimal balance.

2. Network Functions, Components, and Services

A. Application Load Balancer (ALB)

Layer

OSI Layer 7 – Application Layer
Operates at the highest layer of the OSI model, which allows content-based routing.

Function

Distributes incoming HTTP/HTTPS traffic to multiple backend targets (instances, containers, Lambda functions) based on:

Path-based routing (e.g., /api, /static)

Host-based routing (e.g., api.example.com, shop.example.com)

HTTP headers (e.g., user-agent, authorization tokens)

Query parameters (e.g., ?env=prod)

Path-based routing (e.g., /api, /static)
Host-based routing (e.g., api.example.com, shop.example.com)
HTTP headers (e.g., user-agent, authorization tokens)
Query parameters (e.g., ?env=prod)

Capabilities

| Feature | Description | | SSL Termination | Offloads SSL processing from backend servers, improving performance and centralizing TLS certificate management. | | WebSocket Support | Enables real-time bi-directional communication (e.g., chat apps, live dashboards). | | Sticky Sessions | Ensures a user's requests are routed to the same backend during a session using cookies or header-based affinity. | | Target Groups | ALB supports dynamic backend groups (EC2, ECS, Lambda) for scalable app tiers. | | Health Checks | Periodic checks on backend instances to avoid routing traffic to unhealthy targets. |

Real-World Use Case

E-commerce Website Architecture

/api/ endpoints (checkout, user auth) are routed to a Kubernetes service exposing microservices.

/static/ requests (images, CSS, JS) are routed to an S3 bucket behind CloudFront or to a static content Nginx server.

TLS Termination happens at the ALB using ACM (AWS Certificate Manager).

ALB integrates with WAF to protect against OWASP Top 10 threats.

Common Providers

AWS Application Load Balancer
Azure Application Gateway (ALB equivalent in L7 mode)
GCP HTTP(S) Load Balancer

B. Network Load Balancer (NLB)

Layer

OSI Layer 4 – Transport Layer
Operates based on TCP/UDP port-level traffic without inspecting the application payload.

Function

Distributes TCP or UDP traffic based on:

IP protocol

Port number

Static IPs

Connection hashing (source IP + port)

IP protocol
Port number
Static IPs
Connection hashing (source IP + port)
Designed for ultra-low latency and high-throughput use cases.

Capabilities

Real-World Use Case

Online Gaming Infrastructure

Multiplayer game sessions require high-speed, low-latency communication between players.

Backend game servers (in EC2 or bare-metal) receive UDP/TCP traffic directly via AWS NLB.

TLS is terminated at the backend to maintain end-to-end encryption.

Used in gaming platforms like EA, Epic Games, or Riot Games.

Key Differences from ALB

C. Application Gateway

Definition

An Application Gateway is a Layer 7 managed web traffic load balancer that includes security features like Web Application Firewall (WAF), SSL offloading, and intelligent routing. It is often cloud provider-managed and tightly integrated with application-specific services.

Capabilities

Real-World Use Case

Healthcare Provider Web Portal

Sensitive patient data and health services are accessed via a public-facing Azure web portal.

Azure Application Gateway with WAF is deployed to:

Decrypt TLS traffic using secure certificates (SSL offload).

Apply OWASP ruleset to inspect and block malicious requests.

Route traffic to Azure App Services, VMs, or Kubernetes clusters based on URL patterns.

Meets HIPAA compliance via encrypted transit and attack prevention.

Provider-Specific Examples

D. Content Delivery Network (CDN)

Definition

A Content Delivery Network (CDN) is a globally distributed system of caching edge servers that deliver content (web pages, videos, images, APIs) to users from locations that are geographically closer to them than the origin server.

Key Technical Concepts

Edge Locations / Points of Presence (PoPs): Geographically dispersed servers that cache and serve content.
Origin Server: The main server where the application or media content is stored.
TTL (Time to Live): Defines how long cached content stays at the edge before checking the origin.
Cache Invalidation: Manually or automatically removes/updates outdated content from the CDN cache.

Benefits

| Benefit | Description | | Reduced Latency | Content is served from nearby edge nodes, decreasing round-trip time (RTT). | | Reduced Origin Load | Offloads content delivery from the origin server, allowing it to focus on dynamic processing. | | Scalability & DDoS Protection | CDNs can absorb traffic spikes and mitigate volumetric DDoS attacks by distributing load across global servers. | | Improved Availability | If the origin server is unavailable, cached content can still be served. | | Performance Optimization | CDNs can compress assets, perform TCP optimizations, and support HTTP/2, QUIC. |

Major CDN Providers

AWS CloudFront

Integrates with S3, EC2, Lambda@Edge.

Supports signed URLs/cookies for restricted content access.

Integrates with S3, EC2, Lambda@Edge.
Supports signed URLs/cookies for restricted content access.
Azure CDN (Standard/Premium)

Deep integration with Azure Blob Storage and App Services.

Powered by Akamai or Verizon.
Deep integration with Azure Blob Storage and App Services.
Google Cloud CDN

Integrated with Google Cloud HTTP(S) Load Balancer.

Automatic SSL and IPv6 support.

Integrated with Google Cloud HTTP(S) Load Balancer.
Automatic SSL and IPv6 support.

Real-World Use Case

Streaming Platform (e.g., Netflix, Disney+)

Uses CDN edge nodes to deliver high-definition video content.

Videos are segmented and cached at regional PoPs.

Adaptive bitrate streaming ensures smooth playback even on low-bandwidth connections.

CloudFront or Akamai CDN is often used in multi-CDN strategies.

E. Firewalls

Definition

A firewall is a network security system—hardware-based, software-based, or cloud-native—that monitors and controls traffic based on defined security rules.

Cloud Context

| Type | Description | | Network Firewalls | Protect at the subnet or VPC boundary (e.g., AWS Network Firewall, Azure Firewall). | | Host-based Firewalls | Implemented on individual instances or containers (e.g., iptables, ufw, Windows Defender Firewall). | | Application Firewalls (WAF) | Protects Layer 7 (HTTP/HTTPS) apps from attacks like SQL injection, XSS, CSRF. |

Firewall Features

Stateless and Stateful Inspection
Packet Filtering and Deep Packet Inspection (DPI)
Threat Intelligence Feeds
Logging and Monitoring Integration
FQDN Filtering (allow/block domain names)

Real-World Use Case

Enterprise with Zero Trust Architecture

Implements Azure Firewall in combination with NSGs (Network Security Groups).

Enforces least privilege access, blocking all inbound traffic by default.

Only approved services (via Service Tags or FQDN rules) are allowed egress.

Logs forwarded to Azure Sentinel or AWS GuardDuty for analysis.

F. Virtual Private Cloud (VPC)

Definition

A Virtual Private Cloud (VPC) is a logically isolated section of a cloud provider's network where users define custom IP ranges, route tables, subnets, and security controls for deploying cloud resources securely.

Core Components

Benefits

Custom IP Addressing: RFC 1918 ranges (e.g., 10.0.0.0/16)
Security Isolation
Granular Control Over Routing
Hybrid Connectivity via VPNs or Direct Connect

Real-World Use Case

Multi-tier Web Application Deployment

Frontend servers in public subnets.

Backend databases in private subnets.

Security groups restrict access: only the web tier can talk to the DB tier.

NAT Gateway provides internet access for patching internal instances.

i. VPC Peering

Definition

VPC Peering establishes a direct network route between two VPCs (within or across accounts) that allows traffic to be exchanged privately without traversing the public internet.

Key Features

Low-latency, private routing
No single point of failure
Supports intra-account and inter-account connections
Security Group referencing (in some clouds)

Limitations

Real-World Use Case

Dev and Prod Segmentation

A SaaS company maintains separate VPCs for development, staging, and production.

Read-only peering allows dev teams to query production telemetry data without affecting production resources.

Peering avoids costs and delays of NAT or VPN.

ii. Transit Gateway (TGW)

Definition

A Transit Gateway (TGW) is a centralized, cloud-native network hub that connects multiple VPCs, on-premises networks (via VPN or Direct Connect), and edge locations using a hub-and-spoke model.

Benefits

Architecture Example

TGW connects:

10 VPCs across different business units

2 on-prem data centers via IPSec VPN

Cloud firewalls and security appliances in a dedicated inspection VPC

10 VPCs across different business units
2 on-prem data centers via IPSec VPN
Cloud firewalls and security appliances in a dedicated inspection VPC

Real-World Use Case

Global Enterprise Network Fabric

A multinational corporation uses AWS Transit Gateway to connect:

50+ regional VPCs across multiple AWS regions.
VPN connections from multiple physical sites.
Security VPC that inspects all traffic between VPCs via route propagation.

Reduces operational complexity and enables scalable segmentation and monitoring.

G. Subnets

Definition

A subnet (short for subnetwork) is a segmented range of IP addresses within a Virtual Private Cloud (VPC) that logically separates and organizes resources such as virtual machines, databases, or containers. Subnets allow for finer control over routing, access control, and traffic flow within a cloud environment.

Types of Subnets

| Type | Description | | Public Subnets | Subnets associated with a route to an Internet Gateway (IGW). Resources in these subnets can receive inbound and outbound internet traffic (if security groups/NACLs allow). | | Private Subnets | Subnets not associated with an Internet Gateway. They can still initiate outbound traffic via NAT Gateways/Instances, but cannot receive unsolicited inbound traffic from the internet. | | Isolated Subnets (optional classification) | Subnets with no route to the internet—either inbound or outbound. Ideal for ultra-sensitive workloads (e.g., databases, logging systems). |

Subnet Use Case

Three-Tier Architecture Example:

Web Tier (e.g., Nginx, Apache) in public subnets.

App Tier (e.g., backend microservices) in private subnets.

Database Tier (e.g., MySQL, PostgreSQL) in isolated subnets.

NAT Gateway deployed in a public subnet enables outbound access from private subnets for OS updates or API requests.

Best Practices

Follow CIDR planning to avoid IP exhaustion and overlap.
Use Network ACLs at the subnet level and Security Groups at the instance level for layered security.
Implement Multi-AZ subnetting for fault tolerance (e.g., subnet-az1, subnet-az2).

H. Routing and Switching

1. Virtual Local Area Network (VLAN)

Definition

A VLAN is a logical partition of a Layer 2 network that groups hosts together even if they are not on the same physical switch. Each VLAN acts as an independent broadcast domain, isolating traffic for improved security and performance.

Use Case

On-Premises or Hybrid Cloud

An organization uses VLANs to segregate traffic for HR, Finance, and IT departments in a shared data center.

Each VLAN is associated with a different 802.1Q tag and routed by a Layer 3 switch or router.

Cloud Context

Native VLAN support is not directly exposed in public cloud VPCs.
However, similar isolation is achieved using subnets, security groups, route tables, and NSGs (Azure).
VLAN tagging and segmentation are supported in hybrid connectivity options (e.g., AWS Direct Connect or Azure ExpressRoute circuits via partner network providers).

2. Software-Defined Networking (SDN)

Definition

SDN decouples the control plane (logic and routing decisions) from the data plane (actual packet forwarding) using software-based controllers. This enables centralized network management and automation.

Key Features

Programmability via APIs (e.g., REST, gRPC).
Dynamic Policy Enforcement using central SDN controllers.
Support for microsegmentation and service chaining.
East-West and North-South traffic control.

Use Case

Kubernetes with Calico or Flannel

Calico enables IP-based policies, BGP peering, and network policy enforcement between pods.

Operators can dynamically adjust network access between microservices using Kubernetes NetworkPolicy CRDs.

3. Border Gateway Protocol (BGP)

Definition

BGP is a Layer 3 exterior gateway protocol (EGP) used to exchange routing information between autonomous systems (AS). In cloud and hybrid environments, BGP is used to dynamically advertise and learn routes over VPNs, Direct Connect, or ExpressRoute connections.

Key Features

AS_PATH attribute to prevent routing loops.
Prefix-based route advertisement.
Route filtering and community tagging.
Support for failover and multipath routing.

Use Case

AWS Direct Connect + On-Prem Data Center

An enterprise connects their on-prem Cisco routers to AWS via DX + BGP.

On-prem routers advertise internal corporate IP ranges to AWS, while AWS advertises VPC CIDRs to the data center.

When a router fails, BGP convergence ensures failover to a secondary path.

4. Static Routes

Definition

Static routes are manually configured entries in a routing table that define the next hop for traffic destined to a specific network or IP prefix.

Use Case

Small or Legacy Network

A company configures static routes from an EC2 instance to an internal bastion server, used to SSH into isolated subnets.

Suitable for simple network topologies with predictable routing paths.

Limitations

No auto-convergence on path failure.
Difficult to scale or maintain in multi-VPC or hybrid environments.
Susceptible to human error during manual configuration.

5. Route Tables

Definition

A route table is a set of routing rules within a VPC/subnet that determines how traffic is forwarded based on the destination IP address.

Components

Destination CIDR Block
Target (e.g., IGW, NAT Gateway, VPC Peering, Transit Gateway, ENI, Local)
Propagation (optional, for VPNs and Transit Gateway)

Use Case

Mixed Routing Policy

A VPC has:

Public subnets with routes: 0.0.0.0/0 → Internet Gateway

Private subnets with routes: 0.0.0.0/0 → NAT Gateway

Internal subnets with routes: 10.0.0.0/8 → Local

Cloud provider enforces implicit local routing between subnets in the same VPC.

Advanced Example

Transit Gateway Integration

Route tables in AWS TGW define segmentation between departments.

Finance VPCs can communicate with accounting VPCs but not with developer VPCs.

Route propagation handles dynamic route insertion from VPN connections.

Summary Table