Study Guide: Cloud and Hybrid Network Design

Answer these questions to gauge your current understanding before studying the material.

Pre-Quiz

1. An enterprise requires 99.99% availability for its AWS Direct Connect architecture supporting critical production workloads. Which resiliency model should the network designer implement?

A single Direct Connect connection with redundant virtual interfaces Two single connections to a single location on separate devices Separate connections terminating on separate devices in more than one location A single connection with active/passive BGP failover

2. A multinational company needs to exchange traffic between two on-premises sites through the Microsoft network backbone without routing through Azure VNets. Which feature should the designer use?

Azure Virtual WAN Hub ExpressRoute Global Reach Azure VNet Peering Azure Front Door

3. What is the primary advantage of Google Cloud's Cross-Cloud Interconnect compared to building a traditional colocation hub for multi-cloud connectivity?

It supports higher bandwidth than dedicated interconnect It provides private connectivity directly between cloud providers without routing through on-premises infrastructure It eliminates the need for BGP routing It is available only for connections between GCP and AWS

4. An organization is deploying Cisco SD-WAN Cloud OnRamp. What is the primary architectural function of the Catalyst 8000v routers deployed in the cloud?

They serve as DNS resolvers for cloud-hosted applications They function as Network Virtual Appliances (NVAs) extending the enterprise SD-WAN fabric into the cloud They replace the cloud provider's native load balancers They act as hypervisors for cloud-based virtual machines

5. How does the level of network control change across cloud service models from the enterprise perspective?

SaaS offers the most control because the enterprise manages the application layer PaaS offers the most control because the platform abstracts complexity IaaS provides full network control (VPCs, routing, security groups), PaaS provides partial control (endpoints), SaaS provides minimal control (client-side only) All three models provide equal network control through different interfaces

6. A healthcare organization must comply with HIPAA while migrating workloads to a hybrid cloud. Which network design element is NOT specifically required by HIPAA?

Encryption of PHI in transit Data residency within the EU Role-based access control with audit trails Physical, network, and process security measures

7. In a hub-and-spoke multi-cloud architecture, what role does a carrier-neutral colocation facility typically serve?

It hosts the enterprise's primary production workloads It serves as the central interconnect point connecting to each cloud provider's native transit construct It replaces the need for cloud-native hub services like Transit Gateway It provides SaaS application hosting for the enterprise

8. Why is centralizing DNS resolution problematic for SaaS application performance?

Centralized DNS cannot resolve SaaS provider domain names SaaS providers use DNS-based traffic management, and centralizing DNS can inadvertently route users to distant endpoints Centralized DNS servers are incompatible with cloud service providers SaaS applications do not use DNS at all

9. An architect is designing a placement strategy for a workload with highly variable demand and API-driven integrations. Which hosting model best fits these requirements?

On-premises with reserved hardware capacity SaaS with minimal customization Public cloud (IaaS/PaaS) for elastic scaling and API-native integration Private cloud with fixed infrastructure allocation

10. What is the fundamental principle behind data sovereignty in cloud network design?

All data must be stored in the cloud provider's primary region Data is subject to the laws and governance structures of the country where it is collected or processed Data sovereignty only applies to government organizations Cloud providers automatically ensure data sovereignty compliance

11. Which Azure ExpressRoute peering type enables private connectivity to Microsoft 365 and Azure PaaS services?

Private Peering Public Peering Microsoft Peering Global Peering

12. An enterprise uses PaaS services extensively and needs to keep traffic off the public internet. Which design pattern should they implement?

Configure public IP addresses on all PaaS instances Deploy Private Endpoints / Private Link to route PaaS traffic over the provider's backbone Use internet-based access with TLS encryption only Implement split tunneling to bypass VPN concentrators

13. PCI DSS explicitly identifies which network design element as critical for protecting cardholder data environments?

Multi-region deployment SD-WAN cloud on-ramp integration Network segmentation to isolate cardholder data environments Direct Connect with Transit VIF

14. When comparing dedicated cloud connectivity to optimized internet access, which characteristic best describes dedicated connectivity?

Lower cost and faster setup time Predictable latency, guaranteed bandwidth, and private path with no internet exposure Best suited for SaaS access and development/test workloads Requires only existing internet circuits

15. Why should compliance requirements be treated as primary design inputs rather than afterthoughts in hybrid cloud architecture?

Because compliance tools are cheaper when purchased during initial deployment Because data classification must drive workload placement, and segmentation, encryption, and access controls must be designed into the architecture from the beginning Because cloud providers only offer compliance features during initial provisioning Because regulatory auditors only review the initial architecture documentation

Section 1: Cloud Connectivity Architecture

The first design decision in any hybrid cloud architecture is how to connect. The choice between dedicated private connections, internet-based access, and SD-WAN integration shapes every subsequent design decision -- from routing policy to security posture to application performance.

AWS Direct Connect

AWS Direct Connect provides dedicated network connections from on-premises environments to AWS, bypassing the public internet. It supports three types of virtual interfaces:

Virtual Interface Type	Purpose	Typical Use Case
Private VIF	Connectivity to resources within Amazon VPCs	EC2 instances, RDS databases, VPC-resident services
Public VIF	Connectivity to AWS public resources	S3, AWS global services, public IP addresses
Transit VIF	Connectivity to AWS Transit Gateway	Connecting multiple VPCs through a single interface

Resiliency Models

AWS provides tiered resiliency models that every CCDE candidate should understand:

Maximum Resiliency: Separate connections on separate devices in multiple locations. Protects against device, connectivity, and complete location failure. Recommended for critical production workloads.
High Resiliency: Two single connections to multiple locations. Protects against fiber cuts and device failures.
Development and Test: Separate connections on separate devices in a single location. Suitable only for non-critical workloads.

graph TD subgraph MaxRes["Maximum Resiliency"] A1[Location A - Device 1] --> AWS1[AWS Region] A2[Location A - Device 2] --> AWS1 B1[Location B - Device 1] --> AWS1 B2[Location B - Device 2] --> AWS1 end subgraph HighRes["High Resiliency"] C1[Location A - Single Conn] --> AWS2[AWS Region] D1[Location B - Single Conn] --> AWS2 end subgraph DevTest["Development and Test"] E1[Location A - Device 1] --> AWS3[AWS Region] E2[Location A - Device 2] --> AWS3 end Enterprise[Enterprise Data Center] --> A1 Enterprise --> A2 Enterprise --> B1 Enterprise --> B2

Figure 15.1: AWS Direct Connect resiliency models -- Maximum Resiliency uses separate devices in multiple locations, High Resiliency uses single connections in multiple locations, and Development/Test uses separate devices in a single location.

Azure ExpressRoute

Azure ExpressRoute delivers private connectivity through dedicated circuits with built-in dual BGP redundancy. Each circuit consists of two connections to two Microsoft Enterprise Edge routers (MSEEs). ExpressRoute supports two peering models:

Peering Type	Scope	Key Design Consideration
Private Peering	Azure VMs, cloud services within a VNet	Trusted extension of your core network into Azure
Microsoft Peering	Microsoft 365, Azure PaaS, PSTN services	Bi-directional connectivity to Microsoft online services

ExpressRoute Global Reach enables data exchange between on-premises sites through ExpressRoute circuits, with traffic traversing the Microsoft backbone -- eliminating the need for site-to-site VPN tunnels for inter-site communication.

Google Cloud Interconnect

Google Cloud offers three interconnect options:

Type	Bandwidth	Requirement	SLA
Dedicated Interconnect	10/100 Gbps	Physical presence at colocation	Up to 99.99%
Partner Interconnect	50 Mbps - 50 Gbps	Connection through partner	Up to 99.99%
Cross-Cloud Interconnect	Varies	Multi-cloud environment	99.9% or 99.99%

Cross-Cloud Interconnect provides private, secure connectivity directly between cloud providers with line-rate performance, enabling true multi-cloud architectures without routing through on-premises infrastructure.

SD-WAN Cloud On-Ramp and Internet-Based Access

SD-WAN Cloud OnRamp automates the extension of enterprise WAN into cloud environments by deploying virtual SD-WAN routers (NVAs) directly within cloud provider networks. Key features include site-to-cloud, intra-cloud, and inter-cloud connectivity from a single fabric with unified policy and segmentation.

Internet-based access remains common for SaaS and non-critical workloads. Modern optimization includes SD-WAN path selection, CDN edge locations, DNS-based traffic management, and split tunneling for remote users.

flowchart LR DC[Enterprise Data Center] --> DX[Direct Connect / ExpressRoute / Interconnect] DC --> SDWAN[SD-WAN Cloud On-Ramp] DC --> INET[Optimized Internet Access] DX -->|Private, dedicated path| CSP[Cloud Provider] SDWAN -->|Intelligent path selection| CSP INET -->|Encrypted, best-effort| CSP SDWAN --> SaaS[SaaS Applications] INET --> SaaS DX -->|Transit VIF / vWAN| Multi[Multi-Cloud Hub] Multi --> CSP2[Second Cloud Provider]

Figure 15.2: Cloud connectivity options -- dedicated private connections, SD-WAN cloud on-ramp, and optimized internet access.

Animation: Interactive comparison of traffic flows through Direct Connect (private path), SD-WAN On-Ramp (intelligent path selection), and Internet-based access (encrypted best-effort) showing latency and reliability trade-offs.

Section 2: Hybrid and Multi-Cloud Design

Service Model Network Design Implications

Each cloud service model shifts the responsibility boundary between enterprise and provider, directly impacting network design:

IaaS -- Full Network Control

The enterprise manages VPCs, subnets, route tables, security groups, and NACLs. Cloud data center networks use modified Clos designs with ECMP routing. IaaS demands full routing control, micro-segmentation, multi-region latency optimization, and private connectivity termination.

PaaS -- Partial Network Control

Infrastructure management shifts to the provider, but network integration remains critical. Key concerns include Private Link/Private Endpoints to keep traffic off the public internet, DNS complexity requiring conditional forwarding or private DNS zones, and bandwidth throttling in PaaS tiers.

SaaS -- Minimal Network Control

The enterprise manages only client-side connectivity, yet SaaS traffic often dominates bandwidth. Key concerns include internet path quality, Microsoft Peering for M365, SD-WAN on-ramp optimization, local DNS resolution (centralized DNS can route users to distant endpoints), and VPN split-tunneling decisions.

graph TD ENT[Enterprise Network Team] --> IaaS ENT --> PaaS ENT --> SaaS subgraph IaaS["IaaS -- Full Control"] I1[VPCs / Subnets] I2[Route Tables / BGP] I3[Security Groups / NACLs] I4[Virtual Machines] end subgraph PaaS["PaaS -- Partial Control"] P1[Private Endpoints] P2[Hybrid DNS Zones] P3["Managed Platform (provider)"] end subgraph SaaS["SaaS -- Minimal Control"] S1[Client Connectivity] S2[SD-WAN Path Optimization] S3["Application (provider)"] end

Figure 15.3: Cloud service model responsibility boundaries -- network control decreases from IaaS through PaaS to SaaS.

Workload Placement Decisions

Deciding where a workload should run requires a structured framework evaluating performance, security/compliance, cost, control, integration needs, and staff skills. Key principles:

On-premises: Favored for ultra-low latency, strict data sovereignty, stable predictable workloads, and custom hardware requirements.
Public cloud (IaaS/PaaS): Favored for burst capacity, variable workloads (opex model), global distribution, and API-driven integrations.
SaaS: Favored for standard business functions, minimal customization, and minimal operational overhead.

Multi-Cloud Networking Patterns

The hub-and-spoke pattern is the most common multi-cloud architecture. Each cloud's native hub construct (AWS Transit Gateway, Azure Virtual WAN Hub, GCP Network Connectivity Center) connects through a central interconnect point -- typically a carrier-neutral colocation facility hosting physical routers or SD-WAN edge devices.

graph TD COLO[Carrier-Neutral Colo Hub] --> AWSTGW[AWS Transit Gateway] COLO --> AZWAN[Azure Virtual WAN Hub] COLO --> GCPNCC[GCP Network Connectivity Center] AWSTGW --> VPC1[AWS VPC 1] AWSTGW --> VPC2[AWS VPC 2] AZWAN --> VNET1[Azure VNet 1] AZWAN --> VNET2[Azure VNet 2] GCPNCC --> GVPC1[GCP VPC 1] GCPNCC --> GVPC2[GCP VPC 2] ONPREM[On-Premises DC] --> COLO

Figure 15.4: Hub-and-spoke multi-cloud architecture with a carrier-neutral colocation facility as the central hub.

Cloud Exchange Fabrics (Equinix Fabric, Megaport Cloud Router) provide an alternative to building your own colocation hub, offering private routing across clouds with a single routing domain. Cross-Cloud Direct Connectivity pairs services like Direct Connect with ExpressRoute through colocation providers for private inter-cloud paths.

Animation: Step-by-step build-up of a multi-cloud hub-and-spoke topology, showing how traffic flows from on-premises through the colocation hub to workloads in AWS, Azure, and GCP.

Section 3: Governance and Compliance in Cloud Design

Data Sovereignty and Locale Requirements

Data sovereignty means data is subject to the laws of the country where it is collected or processed. For network designers, this creates concrete constraints on workload deployment and data flows. Sovereign cloud design elements include in-country data centers, geo-fencing policies, operational independence (local staffing and supply chain), and workload portability across cloud types as regulations evolve.

Data Governance Frameworks

Hybrid cloud architecture serves as a compliance architecture when designed properly. Sensitive or regulated data resides in private clouds or regional data centers satisfying sovereignty requirements, while less sensitive workloads leverage public cloud scalability. Hybrid environments provide fine-grained control over where data resides, who can access it, and how it is protected.

flowchart LR CLASS[Data Classification] --> SENS[Sensitive / Regulated Data] CLASS --> GEN[General Workloads] SENS --> PRIV[Private Cloud / On-Premises] SENS --> SOV[Sovereign Cloud Region] GEN --> PUB[Public Cloud] GEN --> SAAS[SaaS Provider] PRIV --> GOV[Governance Controls] SOV --> GOV PUB --> GOV SAAS --> GOV GOV --> ENC[Encryption at Rest and In Transit] GOV --> RBAC[Role-Based Access Control] GOV --> AUDIT[Audit Logging and Monitoring]

Figure 15.5: Data governance framework -- data classification drives placement, with unified governance controls across all locations.

Regulatory Compliance Impact on Design

Three major frameworks shape network design decisions:

GDPR (General Data Protection Regulation)

Protects privacy and personal data of EU citizens
Applies to all companies processing EU citizen data regardless of location
Requires privacy by design and PII encryption at all times
Data residency requirements may require EU-only hosting

HIPAA (Health Insurance Portability and Accountability Act)

Protects patient health information (PHI) in the United States
Requires physical, network, and process security measures
Cloud environments must implement encryption, strict access controls with audit logging, and regular vulnerability assessments
No specific data locale requirement (unlike GDPR)

PCI DSS (Payment Card Industry Data Security Standard)

Global standards for entities handling cardholder data
Network segmentation is explicitly identified as a critical design element
Mandates strong access control, monitoring, and vulnerability management

Design Element	GDPR	HIPAA	PCI DSS
Data Residency	May require EU-only hosting	No specific locale requirement	No specific locale requirement
Encryption in Transit	Required for PII	Required for PHI	Required for cardholder data
Network Segmentation	Recommended (privacy by design)	Required (PHI isolation)	Required (CDE isolation)
Access Control	Role-based, documented	Role-based with audit trail	Strict, need-to-know basis
Audit Logging	Required	Required with retention	Required with retention

Animation: Decision tree walkthrough showing how data classification (PII, PHI, cardholder data, general) maps to placement constraints, encryption requirements, and segmentation rules under GDPR, HIPAA, and PCI DSS.

Post-Study Assessment

Now that you have studied the material, answer the same questions again to measure your improvement.

Post-Quiz