RANGER GAMEZ

CompTIA Network+ (N10-009) · chapter 3 of 29

Day 3: Head in the cloud

In this chapter Objectives 1.3

  1. Cloud models
  2. Cloud networking and connectivity
  3. Practice questions
  4. Chapter recap

Objective 1.3

Cloud models

Deployment models: public, private, hybrid

A public cloud is owned by a provider and shared by many customers over the internet; you pay for what you use. A private cloud is cloud-style infrastructure (self-service, automated) used by only one organization, on site or hosted. A hybrid cloud connects private/on-premises resources with a public cloud so workloads and data can move between them. Kibble keeps payroll on its private cloud and runs the shop in a public cloud: hybrid.

Exam tip Community cloud (several orgs with shared needs) is an extra term you may meet in study guides, but N10-009 lists public, private and hybrid.

Service models: SaaS, PaaS, IaaS

Who manages what? IaaS (infrastructure): the provider gives you virtual machines, storage and networks; you manage the OS and up. PaaS (platform): the provider also runs the OS and runtime; you deploy your code. SaaS (software): you just use the finished app in a browser; the provider runs everything.

         You manage       Provider manages
On-prem  everything       nothing
IaaS     OS, apps, data   hardware, network
PaaS     your app, data   + OS, runtime
SaaS     your settings    everything else
Table of three cloud service models. Rows from top: data and user access, application, OS and runtime, virtualization, hardware and data center. IaaS: you manage data, application and OS; the provider manages virtualization and hardware. PaaS: you manage data and application; the provider manages OS and runtime, virtualization and hardware. SaaS: you manage only data and access; the provider manages everything else.
The more you rent as a service, the more the provider manages; your data and accounts stay yours.

Exam tip Webmail or online CRM = SaaS. "Developers deploy code without patching servers" = PaaS. "Rent VMs and build your own" = IaaS.

Scalability, elasticity, multitenancy

Scalability is the ability to grow capacity to handle more load: scale up/vertical (a bigger VM) or scale out/horizontal (more VMs). Elasticity is doing that automatically in both directions: add servers during the Black Friday spike, remove them when it ends so you stop paying. Multitenancy means many customers (tenants) share the same physical cloud hardware, kept separate by logical isolation.

Exam tip Trap: scalability = can grow. Elasticity = grows AND shrinks on demand, automatically. Multitenancy risk: a noisy or compromised neighbor.

Objective 1.3

Cloud networking and connectivity

NFV: network functions virtualization

NFV replaces dedicated network hardware with software: virtual routers, firewalls, load balancers and WAN optimizers running as VMs. In the cloud this is how you get networking at all, because you cannot rack your own firewall in someone else's data center. You deploy a virtual appliance from the marketplace in minutes.

Exam tip NFV = the function is virtualized. Do not confuse with SDN (separating the control plane from the data plane), coming on Day 8.

Virtual private cloud (VPC)

A VPC is your own logically isolated network inside a public cloud. You choose its private IP range (for example 10.50.0.0/16), carve it into subnets, and decide which subnets are public (reachable via an internet gateway) and which are private (no direct inbound internet). Other tenants cannot see into your VPC.

VPC kibble-shop  10.50.0.0/16
 public   10.50.1.0/24  web load balancer
 private  10.50.2.0/24  app servers
 private  10.50.3.0/24  database

Exam tip Think of a VPC as a virtual branch office whose routers and firewalls are all software.

Network security groups vs security lists

Cloud firewalls come in two flavors. Network security groups attach to individual instances or their virtual NICs and define allowed inbound/outbound traffic (typically stateful: replies are allowed automatically). Network security lists (network ACLs on some clouds) apply to a whole subnet, so every instance in it inherits the rules. Use both: lists for broad subnet rules, groups for per-server rules.

Exam tip Exam pattern: "apply the rule to every server in the subnet" = security list. "Only this database VM accepts 1433 from the app tier" = security group.

Cloud gateways

An internet gateway connects a VPC to the internet in both directions; resources with public IPs in a public subnet use it. A NAT gateway lets instances in a private subnet start connections out to the internet (to download patches, for example) while blocking connections started from the internet. The NAT gateway itself sits in a public subnet.

A cloud VPC, 10.50.0.0/16, drawn as a box with three subnets. The public subnet 10.50.1.0/24 holds a NAT gateway and the web load balancer; the load balancer is reached through the internet gateway (IGW) in both directions. The private subnets 10.50.2.0/24 for app servers and 10.50.3.0/24 for the database have no inbound path from the internet; the app servers reach out for updates through the NAT gateway, which uses the internet gateway, outbound only.
Internet gateway: both ways for public subnets. NAT gateway: outbound only for private subnets.

Exam tip Private servers need updates but must not be reachable from the internet? NAT gateway. Public web tier? Internet gateway.

Connecting the office to the cloud: VPN vs Direct Connect

A cloud VPN builds an encrypted IPsec tunnel from your firewall to the cloud over the public internet: quick and cheap, but speed and latency vary with the internet. Direct Connect (a dedicated/private connection) is a private circuit from your site or colocation facility into the provider's network: consistent bandwidth and latency, does not cross the public internet, but costs more and takes weeks to provision.

Two ways to link the office to a cloud provider. Top: a cloud VPN, an encrypted IPsec tunnel over the public internet; quick and cheap, but speed and latency vary. Bottom: Direct Connect, a dedicated private circuit from the office or colocation facility into the provider's network; consistent bandwidth and latency and never crosses the internet, but it costs more and takes weeks to set up.
VPN: cheap and quick over the internet. Direct Connect: private, steady, costly.

Exam tip Need predictable latency for heavy, steady traffic? Direct Connect. Need it working this afternoon on a budget? VPN. Many companies run a VPN as backup to the private link.

Check yourself 1During a holiday sale, the shop automatically adds web servers as traffic rises and removes them overnight to cut costs. Which cloud concept is this?

  1. Multitenancy
  2. Elasticity
  3. Hybrid deployment
  4. Vertical scaling
Show the answer

Answer: B. Elasticity

Elasticity is automatic growing and shrinking of resources to match demand. Scalability alone means the system can grow; elasticity adds automatic scale-in when demand drops.

Check yourself 2Kibble's developers want to upload code and let the provider run the OS, runtime and patching. Which service model fits?

  1. IaaS
  2. SaaS
  3. On-premises
  4. PaaS
Show the answer

Answer: D. PaaS

PaaS gives developers a managed platform: the provider handles the OS and runtime, the customer manages the app and data. IaaS would leave OS patching to Kibble.

Practice questions

Answer in your head, then open the answer. Ranger's Packet Trail has 483 questions like these for Network+, with mock exams.

Question 1A company stops running its own mail server and switches to a hosted email and office suite. Users just sign in through a browser, and the provider manages the application, servers and updates. Which cloud service model is this?

  1. PaaS
  2. SaaS
  3. Hybrid
  4. IaaS
Show the answer

Answer: B. SaaS

With SaaS the provider runs the whole application and the customer just uses it. With IaaS the customer still manages the operating system and applications.

Question 2A team rents virtual machines, virtual networks and block storage from a cloud provider. The team installs and patches the operating systems and runs its own applications. Which service model are they using?

  1. PaaS
  2. IaaS
  3. SaaS
  4. Private cloud
Show the answer

Answer: B. IaaS

IaaS provides the raw compute, storage and networking, while the customer manages the OS and everything above it. With PaaS the provider also manages the OS and runtime.

Question 3Developers want to upload their web application code and have the provider handle the operating system, runtime, scaling and patching. They don't want to manage virtual machines. Which service model fits BEST?

  1. PaaS
  2. SaaS
  3. Multitenancy
  4. IaaS
Show the answer

Answer: A. PaaS

PaaS supplies a managed platform and runtime so developers only deploy code. IaaS would leave the developers managing VMs and the OS.

Question 4A hospital keeps its patient records database in an on-premises cloud it owns, while its appointment-booking website runs on a public cloud provider. The two environments are connected and managed together. Which deployment model is this?

  1. Community
  2. Private
  3. Public
  4. Hybrid
Show the answer

Answer: D. Hybrid

A hybrid cloud combines private and public cloud resources that work together. A purely private or purely public model would use only one of the two.

Question 5A cloud provider runs many customers' workloads on the same physical servers and storage, while keeping each customer's data and networks logically separated. Which cloud concept does this describe?

  1. Scalability
  2. Elasticity
  3. Multitenancy
  4. Direct Connect
Show the answer

Answer: C. Multitenancy

Multitenancy means multiple customers share the same physical infrastructure with logical isolation. Elasticity is about growing and shrinking resources to match demand.

Practice it in Ranger's Packet TrailThe same lessons as a story, with drills, hands-on labs and mock exams. Free, in your browser.
Play free

CompTIA, A+, Network+, Security+ and Linux+ are trademarks of CompTIA, Inc. Ranger Gamez is not affiliated with or endorsed by CompTIA. The practice questions are written to the published exam objectives; they are not real exam questions.