Cloud networking

Cloud networking is the design of the private networks cloud resources live in, and of the paths between them, the internet and an organisation's own sites. Nothing is cabled by hand; every network, route and rule is a configuration object created through an API. That makes networks quick to build and just as quick to build badly, since a single route or rule can expose a database or cut off a region.

• Virtual networks and subnets: an address range you control inside the provider, split into public subnets that face the internet and private ones that do not. AWS calls it a VPC, Azure a virtual network.
• Routing and gateways: route tables decide where traffic goes, and NAT gateways let private resources reach outwards without becoming reachable themselves.
• Filtering: security groups and network access control lists act as firewalls around resources and subnets.
• **Load balancing**: spreading requests across healthy targets, either at the application layer (layer 7) or at the transport layer (layer 4).
• **DNS and content delivery**: names that send users to the right region, and edge caches that serve content close to them.
• Hybrid links: a site-to-site VPN over the internet, or a dedicated private circuit such as AWS Direct Connect or Azure ExpressRoute.

How the exams test it

The SAA-C03 blueprint has no networking domain, yet networks run through all four. The secure-architecture domain asks for VPC designs built from security groups, route tables, network ACLs and NAT gateways, and for segmentation into public and private subnets. The performance domain wants topologies for global, hybrid and multi-tier systems and a choice between VPN, Direct Connect and PrivateLink. The cost domain asks where traffic between regions and zones adds charges, and when one shared NAT gateway will do instead of one per zone. AZ-104 gives virtual networking a domain of its own for Azure administrators, and AZ-900 introduces virtual networks, subnets, peering, Azure DNS, VPN Gateway and ExpressRoute by name. Google's Professional Cloud Architect examines network design on its platform at architect level.

The habit that follows people from the data centre

Experienced network engineers adapt fastest, but they bring one habit that misleads: treating the network boundary as the main line of defence. Many managed services are reached through provider endpoints rather than your own subnets, so identity policy often decides access as much as a firewall rule does. The opposite mistake belongs to developers, who accept default networks with everything public because it worked on the first attempt. Plan address ranges before the first network exists, since overlapping ranges make peering and hybrid links painful later, and decide early which resources may face the internet at all.