What it means
Controls can include routes, firewalls, proxies, private endpoints, DNS policy, service restrictions, network policies, and identity-aware authorization.
Why it matters
Many cloud environments focus on inbound exposure while allowing broad outbound access. That weakens containment and makes compromised workloads harder to detect.
Practical focus
- Document required destinations and protocols
- Route outbound traffic through observable control points
- Restrict direct internet access from sensitive workloads
- Monitor unusual volume, destinations, and failed attempts
Common mistakes
- Blocking egress without dependency discovery
- Allowing unrestricted access through shared proxies
- Ignoring provider APIs and storage endpoints
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: