Network Functions

🎯 Exam Objectives

🎯

Exam Objective 1.3: Explain cloud networking concepts.

Track your learning progress! Click each objective as you master it:

Configure and differentiate Load Balancer types and algorithms
Compare Stateful and Stateless cloud firewalls
Understand Web Application Firewalls (WAFs) and virtual patching
Differentiate Security Groups and Network ACLs for VPC isolation

⚖️ 7.10 Load Balancers

Load balancers manage traffic to VM instances and services, preventing poor performance and enhancing access. Common settings include Name, Type, Subnet association, and Security group membership.

Distribution Methods

Click on a method to learn how it distributes workloads across servers:

🔄

Round Robin

📊

Static Algorithm

⚡

Dynamic Algorithm

Round Robin: Workloads are assigned to servers in sequence, with no regard for the current work assignment. Simple and effective for identical servers.

Types of Load Balancers

Application Load Balancers (Layer 7)

Operates at the OSI Application layer to distribute workloads across instances supporting web applications (e.g., e-commerce inventory, cart, checkout).

Balances based on server workload or Layer 7 content (e.g., requests for images vs. sound clips). Acts as an application gateway.

Network Load Balancers (Layer 4)

Operates at the OSI Transport layer to maintain efficient connectivity based on network traffic through virtual routers.

Balances based on network connectivity and can scale devices to maintain acceptable performance levels.

Gateway Load Balancers

Scales network appliances based on demand, such as firewalls, Web Application Firewalls (WAFs), and IDS/IPS devices.

Balances based on networking and instance workloads. Often supplements application gateway load balancers.

🧱 7.11 Cloud Firewalls

Firewalls analyze network traffic and apply rules to permit or deny it. By default, most firewalls block all traffic, and administrators define specific exceptions for required applications and services.

Stateful vs. Stateless Firewalls

🔍 Stateful Firewalls

Monitors network communication
Tracks detailed TCP connections and traffic characteristics
Understands the entire network connection
More powerful and context-aware

📦 Stateless Firewalls

Verifies individual packets only
Rules based on source, destination, or protocol
Does not check overall communication process
Faster, ideal for high workloads

Encountering Firewalls

Firewalls exist at many locations within an on-premises and cloud-connected environment:

💻 On-premises end-user workstations

🖥️ On-premises servers (physical/virtual)

🚪 Business network perimeter

☁️ Entering the CSP's network

🌐 Within configured VPCs

📦 Cloud-based VM server instances

🕸️ 7.12 Web Application Firewalls (WAFs)

WAFs operate at Layer 7 (Application layer) to address specific vulnerabilities (like XSS, SQL injections, DDoS). They use virtual patches to mitigate threats at the WAF layer rather than in the application's code, serving as a temporary or permanent fix.

WAF Filtering Criteria

Click on a criterion to see how WAFs use it to filter traffic:

Source IP Address Source Country Matched String Request Size Malicious Code

Source IP Address: WAFs can block or allow traffic based on specific IP addresses or IP ranges, preventing known malicious actors from reaching your cloud resources.

Cloud Provider WAF Solutions

🟠 AWS WAF

Protects CloudFront, API Gateway, Application Load Balancers, and AppSync. Pay-per-rule and per-request inspected.

AWS Marketplace rule groups
Operational expense model

🔵 Azure WAF

Sits in front of Application Gateway, Front Door, and Azure CDN. Can also filter on-premises and multi-cloud traffic.

Based on OWASP vulnerabilities
Auto-updated for new threats

🔴 Google Cloud Armor

Implements rules based on IP, geography, and other criteria to protect web apps from DDoS and XSS.

Geographical filtering
DDoS protection

💡 VPC Isolation: While WAFs protect against Internet threats, internal VPC traffic is isolated using Security Groups (associated with individual VM instances to control access) and Network ACLs (used to filter traffic across entire VPC segments/subnets, generating logs for permitted and denied traffic).