Task Statement 4.1: Implement and maintain network features to meet security and compliance needs and requirements.

📘AWS Certified Advanced Networking – Specialty

1. What is Secure and Compliant Network Architecture?

A secure AWS network architecture means:

Protecting systems from unauthorized access
Controlling traffic flow
Encrypting data
Monitoring activity

A compliant architecture means:

Following rules, standards, and regulations
Meeting internal and external security requirements

2. Core Design Principles (VERY IMPORTANT FOR EXAM)

2.1 Least Privilege Access

Only allow minimum required access
Restrict:
- Ports
- IP ranges
- Protocols

✔ Example:

Allow only port 443 instead of all ports

2.2 Defense in Depth (Layered Security)

Use multiple layers of security controls, not just one.

Layers include:

Network level
Instance level
Application level

2.3 Segmentation and Isolation

Divide your network into smaller parts to reduce risk.

Public Subnets → Internet-facing resources
Private Subnets → Internal resources
Isolated Subnets → Highly sensitive systems

2.4 Zero Trust Approach

Never trust any traffic by default
Verify everything:
- Identity
- Device
- Source

2.5 High Availability + Security Together

Security must not reduce availability
Use:
- Multi-AZ deployments
- Redundant paths

3. Key AWS Network Components for Security

3.1 Amazon VPC (Virtual Private Cloud)

Your isolated network in AWS
Full control over:
- IP addressing
- Routing
- Security

✔ Important for exam:

VPC is the foundation of all network security

3.2 Subnets

Divide VPC into smaller networks.

Types:

Public Subnet
- Has route to Internet Gateway
Private Subnet
- No direct internet access
Isolated Subnet
- No internet, no NAT

✔ Best practice:

Put databases in private/isolated subnets

3.3 Route Tables

Control traffic direction

✔ Security use:

Prevent unwanted routes
Control internet access

3.4 Internet Gateway (IGW)

Allows internet access

✔ Security rule:

Attach only to VPC
Use only for public subnets

3.5 NAT Gateway / NAT Instance

Allow outbound internet from private subnet

✔ Security benefit:

No inbound internet access

4. Traffic Control Mechanisms

4.1 Security Groups (STATEFUL)

Act as virtual firewalls for instances

Key Features:

Allow rules only (no deny)
Stateful:
- Return traffic is automatically allowed

✔ Example:

Allow HTTPS (443) inbound
Automatically allows response traffic

4.2 Network ACLs (STATELESS)

Applied at subnet level

Key Features:

Allow AND Deny rules
Stateless:
- Must allow both inbound and outbound

✔ Exam Tip:

Use NACL for explicit deny rules

4.3 AWS Firewall Manager

Centralized firewall management
Works with:
- Security Groups
- WAF
- Shield

4.4 AWS Network Firewall

Managed network firewall service
Provides:
- Deep packet inspection
- Intrusion detection/prevention

✔ Used in:

Highly secure environments

5. Protecting Application Entry Points

5.1 Elastic Load Balancer (ELB)

Distributes traffic securely

Security Features:

SSL/TLS termination
Integration with WAF

5.2 AWS WAF (Web Application Firewall)

Protects against:
- SQL injection
- XSS attacks
- HTTP-based threats

✔ Works with:

ALB
API Gateway
CloudFront

5.3 AWS Shield

Protects against DDoS attacks

Types:

Shield Standard (automatic)
Shield Advanced (extra protection)

5.4 Amazon CloudFront

CDN with security benefits

✔ Features:

HTTPS enforcement
Geo restriction
Integration with WAF

6. Private Connectivity (Very Important)

6.1 VPC Peering

Connect two VPCs privately

✔ Limitation:

No transitive routing

6.2 AWS Transit Gateway

Central hub to connect multiple VPCs

✔ Security advantage:

Centralized traffic inspection

6.3 AWS PrivateLink

Private access to services

✔ Key benefit:

Traffic stays inside AWS network
No exposure to internet

6.4 VPN (Virtual Private Network)

Encrypted connection from on-premises to AWS

6.5 AWS Direct Connect

Dedicated private connection

✔ Security advantage:

Not exposed to public internet

7. Encryption in Network Architecture

7.1 Data in Transit

Use:
- TLS/SSL
- HTTPS

7.2 Data at Rest

Use:
- AWS KMS (Key Management Service)

7.3 End-to-End Encryption

Encrypt:
- Client → Load Balancer → Backend

8. Monitoring, Logging, and Compliance

8.1 VPC Flow Logs

Capture network traffic logs

✔ Helps in:

Troubleshooting
Security analysis

8.2 AWS CloudTrail

Logs API calls

✔ Important for compliance:

Tracks who did what

8.3 Amazon CloudWatch

Monitoring and alerts

8.4 AWS Config

Tracks configuration changes

✔ Helps:

Detect misconfigurations

8.5 GuardDuty

Threat detection service

✔ Detects:

Suspicious traffic
Unauthorized access

8.6 AWS Security Hub

Central dashboard for security findings

9. Compliance and Governance

9.1 Shared Responsibility Model

AWS secures:
- Infrastructure
You secure:
- Data
- Configuration
- Network settings

9.2 Compliance Standards Supported by AWS

Examples:

ISO
PCI-DSS
HIPAA
SOC

✔ Your architecture must:

Follow these rules
Use proper controls

9.3 Resource Tagging

Helps in:
- Tracking
- Auditing
- Cost allocation

10. Secure Architecture Patterns (Exam Focus)

10.1 Three-Tier Architecture

Web Layer → Public subnet
Application Layer → Private subnet
Database Layer → Isolated subnet

10.2 Hub-and-Spoke Architecture

Central VPC (hub)
Multiple VPCs (spokes)

✔ Used with:

Transit Gateway
Central security inspection

10.3 Inspection VPC

All traffic routed through firewall VPC

✔ Used for:

Deep inspection
Compliance

10.4 Zero Trust Network

No implicit trust
Continuous verification

11. Common Exam Scenarios

You should be able to answer:

✔ How to:

Block traffic → Use NACL
Allow secure access → Security Groups
Prevent internet exposure → Private subnets
Enable secure service access → PrivateLink
Centralize control → Transit Gateway

✔ Choose correct service:

Layer 7 protection → WAF
DDoS protection → Shield
Deep inspection → Network Firewall
Logging → Flow Logs / CloudTrail

12. Best Practices Summary (VERY IMPORTANT)

Use private subnets for sensitive resources
Use least privilege security rules
Enable encryption everywhere
Use multiple layers of security
Monitor all traffic and activities
Use centralized security services
Avoid direct internet exposure
Use private connectivity whenever possible

Final Exam Tip

For this topic, always think:

👉 “Is the architecture secure, isolated, monitored, and compliant?”

If the answer includes:

Segmentation
Encryption
Traffic control
Monitoring
Private access

✅ Then it is likely the correct exam answer.