Domain 1 of 5 · Chapter 3 of 9

Cloud Concepts

Unlock the complete study guide + 1,040 practice questions across 16 full exams.

Bundled into the existing CompTIA Network+ premium course — no separate purchase.

Included in this chapter:

  • The VPC: a private network rented inside a shared datacenter
  • Securing and connecting the VPC: NSGs and gateways
  • Service and deployment models: who owns each layer
  • Scalability, elasticity, and cloud connectivity
  • Exam-pattern recognition

Cloud service models: who manages what (IaaS vs PaaS vs SaaS)

Managed byIaaSPaaSSaaS
Application & dataYouYouProvider
Runtime, middleware, OSYouProviderProvider
Virtualization, servers, storage, networkingProviderProviderProvider
Your main jobRun the OS and everything above itBuild and deploy your appJust use the app
ExampleVirtual machines, VPC, block storageManaged database, app platformWebmail, CRM, online office suite

Decision tree

Connect the VPC to what?public internet vs your datacenterPublic internetYour datacenterNeed inbound exposure?reachable from internet, or outbound onlyYesNoNeed consistent performance?steady low latency vs cheap and quickYesNoInternet gatewaytwo-way internet, public subnetNAT gatewayoutbound only, private subnetDirect connectionprivate circuit, higher costVPN gatewayencrypted tunnel, cheapMany VPCs and sites at once?use a transit gateway as the hubApply NSGs (stateful) on every subnet regardless of which gateway you pick.Internet gateway = inbound + outbound; NAT gateway = outbound only.
Cheat sheet

Cheat sheet

  • A VPC is a logically isolated private network inside the provider's cloud
  • NFV turns physical network appliances into software you spin up on demand
  • An NSG (security group) is a stateful virtual firewall, so replies are allowed automatically
  • NSG is stateful, network ACL is stateless
  • An internet gateway gives a subnet two-way internet; that subnet is the public subnet
  • A NAT gateway is outbound-only: private instances reach out but stay unreachable
  • A VPN gateway terminates the encrypted site-to-site tunnel to your datacenter
  • A transit gateway hubs many VPCs and sites instead of a mesh of peerings
  • IaaS, PaaS, SaaS differ only in where the manage-it line is drawn
  • Shared responsibility: the provider owns more layers as you climb to SaaS
  • Four deployment models answer who the cloud serves
  • Hybrid cloud connects private and public so workloads can move between them
  • Elasticity adds AND automatically removes capacity to track demand
  • Scale up (vertical) vs scale out (horizontal)
  • Multitenancy is the shared-hardware trade that makes isolation mandatory
  • Site-to-site VPN vs direct connection: cheap-and-quick vs consistent-and-private
  • An isolated VPC reaches nothing until you add a route to a gateway
  • Public subnet vs private subnet is defined by the route, not the IPs
  • A new cloud security group denies all inbound, allows all outbound, and matches on a five-tuple
  • Reference another security group as the source to scope access to that group's members

Unlock with Premium — includes all practice exams and the complete study guide.

Also tested in

References

  1. What is Amazon VPC?
  2. Control traffic to your AWS resources using security groups
  3. Network security groups overview
  4. NAT gateways
  5. About VPN Gateway
  6. What is a transit gateway?
  7. The NIST Definition of Cloud Computing (SP 800-145) Whitepaper
  8. What is AWS Direct Connect?