Transitioning from a traditional physical network to the cloud changes how we look at infrastructure. Instead of physical cables and racks, everything is defined by software.
1. Cloud Architecture & Virtualization
NFV (Network Functions Virtualization)
- What it is: In a traditional network, if you need a router, a firewall, and a load balancer, you buy three separate physical boxes. With NFV, those network functions are implemented as software modules (virtual machines) that run on standard commercial servers.
- Simple Example: Instead of buying a physical firewall appliance, you spin up a software-based firewall instance inside your cloud environment.
VPC (Virtual Private Cloud)
- What it is: Your own isolated, private sandbox inside a public cloud provider’s massive network infrastructure.
- Simple Example: Think of the public cloud provider like a massive apartment building. A VPC is your specific apartment. It has its own walls, front door, and rooms (subnets), completely isolated from the neighbors.
Network Security Groups vs. Network Security Lists
Both of these act as virtual firewalls within the cloud, but they look at traffic differently:
- Network Security Groups (NSGs): These are stateful firewalls applied directly to a specific virtual machine or instance. If you allow traffic in, the return traffic is automatically allowed out.
- Network Security Lists: These are stateless firewalls applied to an entire subnet (a whole room of virtual machines). Because it is stateless, you have to explicitly write rules for traffic going in AND traffic going out.
2. Cloud Gateways
Gateways act as the doors to your VPC apartment, controlling how data enters and exits.
- Internet Gateway (IGW): A two-way street. It allows virtual machines in your VPC to connect to the public internet and lets users on the public internet connect to your public cloud resources (such as a web server).
- NAT (Network Address Translation) Gateway: A one-way street. It allows private resources within your cloud (like a secure database server) to download software updates from the internet, but prevents anyone on the outside internet from directly connecting to that database.
3. Cloud Connectivity Options
How do you connect your physical corporate office building to your cloud VPC sandbox?
- VPN (Virtual Private Network): An encrypted, secure tunnel over the public internet. It is relatively cheap and quick to set up, but performance depends on general internet speeds.
- Direct Connect / ExpressRoute: A dedicated, private, physical fiber line leased from a telecom provider that connects directly from your corporate data center to the cloud provider’s data center. It completely bypasses the public internet, offering massive, reliable speeds, but it is highly expensive.
4. Cloud Service & Deployment Models
Service Models (The “Who Manages What” Tier)
- IaaS (Infrastructure as a Service): You rent the raw physical hardware, storage, and networking. You are completely responsible for installing the operating system, managing applications, and security.
- Analogy: Renting an empty plot of land. You build the entire house yourself.
- PaaS (Platform as a Service): The cloud provider handles the hardware and the operating system. They give you a ready-to-use platform where you can just upload your software code.
- Analogy: Renting an unfurnished apartment. The structural maintenance is handled; you just bring your belongings (your application code).
- SaaS (Software as a Service): A complete, finished product that you access entirely through a web browser. The provider manages everything from the hardware to the application itself.
- Analogy: Staying in a fully furnished hotel room. You just show up and use it.
Deployment Models (Where it Lives)
- Public Cloud: Resources are owned and operated by a third-party provider (like AWS, Azure, or Google Cloud) and shared with other customers over the public internet.
- Private Cloud: Infrastructure built exclusively for one organization. It can sit inside their own data center or be managed by a third party, but no one else shares the hardware.
- Hybrid Cloud: A mix of both worlds. An organization keeps its highly sensitive corporate databases in a Private Cloud and uses the Public Cloud to host their public website.
5. Core Cloud Behaviors
Scalability vs. Elasticity
These sound similar, but CompTIA tests the difference carefully:
- Scalability: The ability of a system to handle growing amounts of work by adding resources. It means the system is capable of growing when needed.
- Elasticity: The automation of that growth. An elastic network automatically spins up 5 new servers during a flash sale, and then automatically deletes them at midnight when traffic drops to save money.
Multitenancy
- What it is: A single piece of physical hardware or infrastructure is shared among multiple customers (“tenants”), though their data remains completely separate and invisible to one another due to software limitations.
- Simple Example: A bank vault. Multiple people share the same structural room, but everyone has their own individual safe deposit box key.
Cloud Comparison Table for the Exam
| Cloud Term | Core Focus | Simple Identifier |
| VPC | Isolation | Private apartment in a shared building |
| NSG | Security | Stateful firewall at the VM layer |
| NAT Gateway | Traffic Control | Outbound internet only (one-way street) |
| Direct Connect | Connectivity | Expensive, dedicated private fiber line |
| Elasticity | Scaling | Automatic scaling up and down on demand |