What it means
These components create the actual paths through which workloads reach the internet, private services, on-premises systems, and one another.
Why it matters
A small route or gateway change can expose a service, bypass inspection, or interrupt an entire workload, so intended paths need evidence and change control.
Practical focus
- Associate each subnet with an explicit purpose and route policy
- Minimize default internet paths
- Monitor route and gateway changes as security events
Common mistakes
- Calling a subnet private when it still has an uncontrolled egress path
- Relying on naming instead of route verification
- Adding broad peering routes without transitive-trust analysis
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: