Connecting to the cloud: VPNs, peering and private links

Why this matters

CompTIA's scope bullet for this objective names virtual private networks explicitly, and hybrid architecture is impossible without the connectivity options in this lesson. Every hybrid and multi-cloud design from objective 1.1 rests on one of four mechanisms, and the exam asks you to choose between them given a requirement about bandwidth, latency, cost or privacy.

There is also a quiet cost story here. A great deal of unexpected cloud spend is traffic taking a more expensive path than it needed to — over a NAT gateway and out to the internet when a private endpoint would have kept it inside the provider's network. Knowing the options is knowing where the money goes.

The lesson

Site-to-site IPsec VPN, and the on-premises device that has to agree with it

A site-to-site VPN builds an encrypted tunnel across the public internet between your network and your virtual network. It is the default answer for hybrid connectivity because it is quick, cheap and needs no physical work.

The moving parts:

• A virtual gateway on the cloud side, attached to the virtual network.
• A customer gateway representing your on-premises device — its public address and its capabilities.
• One or more tunnels, usually two for redundancy, each with its own parameters.
• Routing, either static (you declare which prefixes live where) or dynamic via BGP, which is preferable because it fails over and re-converges without manual work.

What actually goes wrong, and what exam scenarios describe:

• Mismatched phase 1 / phase 2 parameters. Encryption algorithm, hash, Diffie-Hellman group and lifetimes must agree on both ends. A mismatch produces a tunnel that never establishes, and the logs say so.
• Overlapping address ranges between on-premises and cloud. Traffic for an overlapping prefix never leaves the local network.
• A device behind NAT without NAT traversal configured.
• Missing route propagation. The tunnel is up and traffic still does not flow because the subnet's route table has no route pointing into the gateway. A tunnel being "up" is not the same as traffic being routed.

The honest limitations: bandwidth is bounded by the internet path and the gateway's own throughput, and latency and jitter are whatever the internet gives you today. For steady, predictable performance you need a dedicated circuit.

Client VPN for individual users, and where it fits against zero-trust access

A client VPN connects individual devices to the virtual network, rather than joining two networks. Its uses are administrative access and giving remote staff reachability to private resources.

Design points the exam cares about:

• Authentication is the interesting half — certificates, directory integration, or federated identity with MFA. Objective 4.2 covers the identity side.
• Split tunnel or full tunnel. Split tunnel sends only cloud-bound traffic through the VPN and leaves general internet traffic on the local connection: better performance, less inspection. Full tunnel sends everything: more control and monitoring, more bandwidth and latency cost.
• Address pool planning. Client addresses come from a range that must not collide with anything routable.

The direction of travel is away from this pattern. A VPN grants network reachability, and network reachability is a coarse permission: once connected, a client can attempt to reach everything the routes allow. The zero-trust alternative grants access to a specific application after evaluating identity and device posture per request, with no broad network adjacency. Where a scenario stresses least privilege, contractor access, or limiting lateral movement, an identity-aware proxy or just-in-time access is the better answer; where it needs a device to behave as though it is on the network, a client VPN is.

Network peering, its non-transitive rule, and the overlapping-CIDR problem it cannot solve

Peering connects two virtual networks so resources address each other privately, using the provider's backbone rather than the internet. It is low-latency, high-bandwidth and simple.

Three properties are examined almost every time:

1. It is not transitive. If A peers with B and B peers with C, A cannot reach C. You need a peering between A and C, or a hub architecture with a transit gateway / virtual WAN that is designed to forward. Candidates who assume transitivity get these questions wrong consistently.
2. Overlapping address ranges cannot be peered. There is no configuration that fixes it; the remedy is renumbering one side, or interposing address translation. This is the delayed consequence of the range choice from the previous lesson.
3. Routes are not automatic. Creating the peering creates the capability; each side's route tables must then point at it, and security rules must still allow the traffic.

Peering is generally cheap — often only the data transferred, at rates well below internet egress — which is precisely why it is the right answer when the requirement is "private, fast, between our own networks".

Dedicated private circuits, when the bandwidth or the latency justifies the lead time

A dedicated circuit (the vendors call it Direct Connect, ExpressRoute, Dedicated/Partner Interconnect) is a private physical link between your network and the provider, usually via a colocation facility or a partner.

What it buys:

• Consistent, predictable latency and bandwidth, because the traffic never touches the public internet.
• High and guaranteed throughput — far beyond what a VPN gateway sustains.
• Cheaper egress rates, which for large volumes can pay for the circuit.
• A defensible answer to auditors about traffic not traversing the internet.

What it costs:

• Lead time measured in weeks or months. This is the detail exam scenarios use to rule it out: if the requirement is "by the end of the month", a dedicated circuit is not the answer however well it fits otherwise.
• Ongoing port and partner charges, and a second circuit if you want resilience — a single circuit is a single point of failure.

The standard mature design is both: a dedicated circuit for normal traffic and a site-to-site VPN as automatic backup. A scenario describing a resilient hybrid link with predictable performance is describing that pair.

Note also that a dedicated circuit is not encrypted by itself. It is private, which is not the same as confidential. Where encryption in transit is required by policy, you run a VPN or application-layer encryption over it.

Private service endpoints that keep traffic to a managed service off the public internet

Managed services — object storage, managed databases, queues — are normally reached at public endpoints. By default, an instance in a private subnet reaching one of them sends traffic out through a NAT gateway to a public address, which is slower, chargeable twice, and awkward to justify to an auditor.

A private endpoint places an interface for that service inside your virtual network with a private address, so the traffic stays on the provider's network. Depending on the provider and the service this appears as a gateway-style route entry or as a private interface with DNS pointing at it.

Why it is worth knowing:

• It removes the NAT gateway from the path, cutting both latency and the per-gigabyte charges that make NAT a billing surprise.
• It allows the workload to have no internet route at all, which is the strongest version of the private-subnet design.
• It supports policy — access to the service can be restricted to requests arriving through the endpoint.
• DNS is the usual failure. The service's public hostname must resolve to the private address from inside the network. If private DNS is not configured or is overridden, the client resolves the public address and the traffic goes the long way round while everything appears to work. That "works but goes the wrong way" failure is a favourite scenario because nothing is broken — only expensive.

What to take into the exam

• Site-to-site VPN = fast to build, internet-dependent performance. Mismatched phase 1/2 parameters and missing route propagation are the classic faults. A tunnel being up does not mean traffic is routed.
• Client VPN grants network reachability; zero-trust grants application-specific access. Prefer the latter where lateral movement is the concern.
• Peering is non-transitive, needs explicit routes, and cannot join overlapping ranges.
• Dedicated circuits give predictable performance and cheaper egress, cost weeks of lead time, need a second link for resilience, and are private but not encrypted.
• Private endpoints keep managed-service traffic off the internet, remove NAT charges, and fail through DNS resolving the public address instead.