Skip to content
GoHackersCloud Academy

Lesson 05 — Enterprise Network Protection Project & Module Review

Learning Path

☁️ Phase 02 – AWS Cloud Security

📘 Module 08 – Network Protection

🎯 Lesson Objective

Section titled “🎯 Lesson Objective”

By the end of this lesson, you will be able to:

  • Design a secure enterprise AWS network architecture.
  • Protect public applications from web attacks.
  • Secure internal network traffic.
  • Centralise firewall management across AWS accounts.
  • Validate enterprise network security controls.
  • Produce professional security architecture documentation.
  • Demonstrate the responsibilities of a Cloud Security Engineer.

📚 Lesson Information

Estimated Time: 5 Hours

Difficulty: Advanced

Prerequisites: Lessons 01–04

Hands-on Project: Yes

💼 Business Scenario

Section titled “💼 Business Scenario”

CloudNova Technologies is preparing to launch its next-generation learning platform.

The new platform includes:

  • Public Web Portal
  • Student Portal
  • Instructor Portal
  • REST APIs
  • Internal Administration Portal
  • Amazon EC2
  • Amazon ECS
  • Amazon RDS
  • Amazon S3
  • Shared Services
  • Multiple AWS Accounts

The company expects over 1 million users during launch week.

The CISO has one final requirement before production deployment.

“Build a secure enterprise network that protects our applications from Internet threats, secures internal communication and supports future business growth.”

As the Cloud Security Engineer, you must design, deploy and validate CloudNova’s complete network protection architecture.

Project Overview

Section titled “Project Overview”

Throughout this project you will implement:

  • AWS WAF
  • AWS Shield
  • Amazon Route 53 Security
  • AWS Network Firewall
  • AWS Firewall Manager
  • Multi-Account Architecture
  • Transit Gateway
  • Inspection VPC
  • Zero Trust Networking

This project combines everything learned throughout Module 08.

Enterprise Architecture

Section titled “Enterprise Architecture”
                                   Internet
                                       │
                                  AWS Shield
                                       │
                                   Amazon Route 53
                                       │
                                  AWS WAF (Web ACL)
                                       │
                           Application Load Balancer
                                       │
                             Public Application Subnet
                                       │
                          Inspection VPC (Firewall Subnet)
                                       │
                           AWS Network Firewall Cluster
                                       │
                               AWS Transit Gateway
                                       │
      ┌─────────────────────┬─────────────────────┬─────────────────────┐
      │                     │                     │
 Production VPC      Shared Services VPC     Development VPC
      │                     │                     │
      ├────── EC2           ├────── DNS          ├────── Test Apps
      ├────── ECS           ├────── Logging      ├────── Developers
      ├────── RDS           ├────── Monitoring   └────── CI/CD
      └────── S3            └────── IAM
                                       │
                              Security Account
                                       │
                 CloudTrail • GuardDuty • Security Hub

Phase 01 — Secure DNS & Edge Protection

Section titled “Phase 01 — Secure DNS & Edge Protection”

Configure:

  • Amazon Route 53
  • Health Checks
  • DNS Failover
  • Route 53 Resolver DNS Firewall

Verify:

  • DNS Resolution
  • Health Status
  • DNS Query Logs

Phase 02 — Protect Web Applications

Section titled “Phase 02 — Protect Web Applications”

Deploy AWS WAF.

Create:

  • Web ACL
  • AWS Managed Rule Groups
  • SQL Injection Protection
  • XSS Protection
  • Rate Limiting
  • Geo Blocking
  • IP Reputation Rules

Associate the Web ACL with the Application Load Balancer.

Verify blocked requests.

Phase 03 — Enable DDoS Protection

Section titled “Phase 03 — Enable DDoS Protection”

Review AWS Shield.

Validate:

  • Protected Resources
  • Layer 3 Protection
  • Layer 4 Protection
  • Shield Recommendations

Understand when an organisation should consider AWS Shield Advanced.

Phase 04 — Deploy Network Firewall

Section titled “Phase 04 — Deploy Network Firewall”

Deploy AWS Network Firewall.

Create:

  • Firewall Policy
  • Stateless Rule Groups
  • Stateful Rule Groups
  • Domain Filtering
  • Logging Configuration

Verify:

  • Allowed Traffic
  • Blocked Traffic
  • Firewall Logs

Phase 05 — Central Policy Management

Section titled “Phase 05 — Central Policy Management”

Using AWS Organizations:

Deploy AWS Firewall Manager.

Create policies for:

  • AWS WAF
  • Network Firewall
  • Security Groups

Verify policy compliance across AWS accounts.

Phase 06 — Build Enterprise Network

Section titled “Phase 06 — Build Enterprise Network”

Review the architecture.

Validate:

  • Transit Gateway
  • Inspection VPC
  • Route Tables
  • Firewall Subnets
  • Security Groups
  • Network ACLs

Confirm all production traffic passes through security controls.

Security Validation

Section titled “Security Validation”

Review the following controls.

Security Control Status
AWS Shield ☐
Route 53 Health Checks ☐
Route 53 DNS Firewall ☐
AWS WAF ☐
Managed Rules ☐
Rate Limiting ☐
AWS Network Firewall ☐
Stateful Rules ☐
Stateless Rules ☐
Firewall Logging ☐
AWS Firewall Manager ☐
Transit Gateway ☐
Inspection VPC ☐

Simulated Enterprise Attack

Section titled “Simulated Enterprise Attack”

CloudNova launches the platform.

Within thirty minutes, the SOC reports:

Event 1

Section titled “Event 1”

Multiple SQL Injection attempts.

Expected Result

✅ Blocked by AWS WAF.

Event 2

Section titled “Event 2”

Cross-Site Scripting attempts.

Expected Result

✅ Blocked by Managed Rules.

Event 3

Section titled “Event 3”

Brute-force login attempts.

Expected Result

✅ Rate-Based Rule activated.

Event 4

Section titled “Event 4”

Traffic from a blocked country.

Expected Result

✅ Geo Match Rule blocks requests.

Event 5

Section titled “Event 5”

Outbound traffic to a malicious domain.

Expected Result

✅ Blocked by AWS Network Firewall.

Event 6

Section titled “Event 6”

Massive DDoS traffic spike.

Expected Result

✅ AWS Shield mitigates infrastructure-level attack.

Investigation Tasks

Section titled “Investigation Tasks”

For every simulated event:

Determine:

  • Which AWS service detected the activity?
  • Which control prevented the attack?
  • Was the application affected?
  • What logs should be reviewed?
  • What improvements could be made?

Document your findings.

Deliverables

Section titled “Deliverables”

Prepare the following documentation.

Enterprise Network Diagram

Section titled “Enterprise Network Diagram”

Include:

  • Route 53
  • AWS Shield
  • AWS WAF
  • Application Load Balancer
  • Transit Gateway
  • Inspection VPC
  • AWS Network Firewall
  • Production VPC
  • Shared Services
  • Security Account

Firewall Policy Document

Section titled “Firewall Policy Document”

Document:

  • Allowed Services
  • Blocked Ports
  • Blocked Protocols
  • Domain Filtering Rules
  • Rate Limiting Rules

Security Architecture Review

Section titled “Security Architecture Review”

Describe:

  • Defence in Depth
  • Zero Trust
  • Traffic Flow
  • Firewall Placement
  • High Availability

Incident Report

Section titled “Incident Report”

Document:

  • Timeline
  • Attack Type
  • Detection Method
  • Containment
  • Recovery
  • Recommendations

Hardening Checklist

Section titled “Hardening Checklist”

Verify:

  • Public resources minimised.
  • Least privilege implemented.
  • Logging enabled.
  • Firewall policies documented.
  • Security rules reviewed.
  • Monitoring configured.

🛠 Capstone Lab

Section titled “🛠 Capstone Lab”

Task 1

Section titled “Task 1”

Deploy:

  • Route 53
  • AWS WAF
  • AWS Shield

Task 2

Section titled “Task 2”

Deploy:

  • AWS Network Firewall

Configure:

  • Stateless Rules
  • Stateful Rules
  • Logging

Task 3

Section titled “Task 3”

Deploy:

  • AWS Firewall Manager

Apply security policies across AWS accounts.

Task 4

Section titled “Task 4”

Validate:

  • Allowed HTTPS Traffic
  • Blocked FTP
  • Blocked Telnet
  • Blocked SQL Injection
  • Blocked XSS
  • Blocked Bot Requests

Document each test.

Task 5

Section titled “Task 5”

Review architecture.

Explain:

  • Why every security layer exists.
  • Which attacks each layer mitigates.
  • How traffic flows through the environment.
  • Where monitoring and logging occur.

💻 AWS CLI Challenge

Section titled “💻 AWS CLI Challenge”

List Web ACLs

Section titled “List Web ACLs”
Terminal window
aws wafv2 list-web-acls --scope REGIONAL

List Firewall Policies

Section titled “List Firewall Policies”
Terminal window
aws network-firewall list-firewall-policies

List Firewalls

Section titled “List Firewalls”
Terminal window
aws network-firewall list-firewalls

List Transit Gateways

Section titled “List Transit Gateways”
Terminal window
aws ec2 describe-transit-gateways

List Route 53 Health Checks

Section titled “List Route 53 Health Checks”
Terminal window
aws route53 list-health-checks

View Shield Protections

Section titled “View Shield Protections”
Terminal window
aws shield list-protections

🏢 Enterprise Best Practices

Section titled “🏢 Enterprise Best Practices”

CloudNova standards include:

  • Protect every Internet-facing workload with multiple security layers.
  • Route traffic through dedicated inspection points.
  • Use AWS Organizations with central policy management.
  • Enable logging on all security services.
  • Review firewall policies regularly.
  • Conduct penetration testing after significant changes.
  • Automate deployments using Infrastructure as Code.
  • Review architecture quarterly to address emerging threats.

🚫 Common Mistakes

Section titled “🚫 Common Mistakes”

❌ Exposing workloads directly to the Internet.

❌ Using AWS WAF without managed rule groups.

❌ Allowing production traffic to bypass the Inspection VPC.

❌ Forgetting to update route tables after deploying AWS Network Firewall.

❌ Managing firewall policies individually in every AWS account.

❌ Ignoring firewall logs and blocked traffic reports.

❌ Assuming one security control is sufficient.

🧪 Final Enterprise Challenge

Section titled “🧪 Final Enterprise Challenge”

CloudNova plans to expand into 10 AWS Regions, supporting millions of learners across multiple continents.

Design a complete enterprise network protection strategy that:

  1. Protects public applications against OWASP Top 10 threats.
  2. Mitigates Layer 3, Layer 4 and Layer 7 attacks.
  3. Implements Zero Trust networking.
  4. Uses Transit Gateway and an Inspection VPC.
  5. Centrally manages firewall policies using AWS Firewall Manager.
  6. Provides high availability and disaster recovery.
  7. Supports future expansion without redesigning the architecture.

Create:

  • Enterprise Architecture Diagram
  • Security Control Matrix
  • Firewall Policy Document
  • Network Hardening Checklist
  • Executive Summary explaining how the solution protects CloudNova from modern cyber threats.

📊 Module Review

Section titled “📊 Module Review”

Congratulations!

You have completed Module 08 – Network Protection.

You can now:

✅ Design secure AWS network architectures

✅ Apply Defence in Depth principles

✅ Implement Zero Trust networking

✅ Protect applications using AWS WAF

✅ Mitigate DDoS attacks with AWS Shield

✅ Secure DNS with Amazon Route 53

✅ Deploy AWS Network Firewall

✅ Centrally manage firewall policies with AWS Firewall Manager

✅ Design Inspection VPCs and Transit Gateway architectures

✅ Build enterprise-grade network protection solutions

📚 Knowledge Check

Section titled “📚 Knowledge Check”
  1. What is Defence in Depth, and why is it important?
  2. How does AWS WAF differ from AWS Network Firewall?
  3. What types of attacks does AWS Shield mitigate?
  4. Why is Route 53 DNS Firewall useful?
  5. What is the purpose of an Inspection VPC?
  6. Why is AWS Transit Gateway preferred in enterprise environments?
  7. What benefits does AWS Firewall Manager provide?
  8. How does Zero Trust improve network security?
  9. Why should firewall policies be centrally managed?
  10. How do all network protection services work together to defend AWS workloads?

💡 Key Takeaways

Section titled “💡 Key Takeaways”

After completing this module, you should understand:

  • Enterprise network security relies on multiple layers of protection, from DNS and DDoS mitigation to web application filtering and deep packet inspection.
  • AWS WAF, AWS Shield and Route 53 protect the Internet-facing edge, while AWS Network Firewall secures traffic inside AWS environments.
  • AWS Firewall Manager simplifies policy enforcement across multiple AWS accounts, ensuring consistent security at scale.
  • Transit Gateway, Inspection VPCs and Zero Trust principles enable secure, scalable and manageable enterprise architectures.
  • A Cloud Security Engineer must be able to design, deploy, validate and document secure network architectures that support both business growth and evolving cyber threats.

🎓 Module Complete

Section titled “🎓 Module Complete”

Excellent work!

You have successfully completed Module 08 – Network Protection.

You now have the knowledge to design and secure enterprise AWS networks using industry best practices and AWS-native security services.

🚀 Next Module

Section titled “🚀 Next Module”

➡️ Module 09 — Vulnerability & Compliance Management

In the next module, you will learn how to:

  • Assess workloads using Amazon Inspector
  • Discover unintended access with IAM Access Analyzer
  • Identify sensitive data exposure using Amazon Macie
  • Perform vulnerability management and patching
  • Build continuous compliance processes
  • Develop enterprise remediation workflows

You will shift from protecting the environment to continuously identifying, assessing and reducing security risks, another key responsibility of a Cloud Security Engineer.