Skip to content

GCP Professional Cloud Network Engineer - Comprehensive Fact Sheet

Table of Contents

Exam Overview

📖 Professional Cloud Network Engineer Certification - Official certification page with exam guide and sample questions

📖 Exam Guide PDF - Detailed exam domains and objectives breakdown

Exam Details: - Duration: 2 hours - Questions: 50-60 (multiple choice and multiple select) - Cost: $200 USD - Validity: 2 years - Languages: English, Japanese - Format: Remote or test center

Exam Domains: 1. Designing, planning, and prototyping a GCP network (26%) 2. Implementing Virtual Private Cloud (VPC) instances (21%) 3. Configuring network services (23%) 4. Implementing hybrid interconnectivity (14%) 5. Implementing network security (16%)

Virtual Private Cloud (VPC)

VPC Fundamentals

📖 VPC Overview - Comprehensive introduction to Virtual Private Cloud networking in GCP

📖 VPC Networks - Detailed documentation on VPC network creation and management

📖 Subnets - Understanding subnet creation, modification, and regional characteristics

📖 Auto Mode vs Custom Mode VPC - Comparison of automatic and custom subnet creation modes

📖 VPC Network Architecture Best Practices - Design patterns and recommendations for production VPC networks

📖 Expanding Subnet IP Ranges - How to expand existing subnet CIDR ranges without disruption

📖 Creating VPC Networks - Step-by-step guide for creating and configuring VPC networks

📖 Alias IP Ranges - Configuring multiple internal IP addresses on VM network interfaces

📖 Multiple Network Interfaces - Attaching VMs to multiple VPC networks simultaneously

Firewall Rules

📖 VPC Firewall Rules Overview - Understanding stateful firewall rule implementation in GCP

📖 Firewall Rules Components - Direction, priority, action, target, source/destination filters

📖 Hierarchical Firewall Policies - Organization and folder-level firewall policy management

📖 Firewall Rules Logging - Enabling and analyzing firewall rule logs for security auditing

📖 Firewall Insights - Analyzing firewall rule usage and optimizing configurations

📖 Network Tags - Using tags to apply firewall rules to specific VM instances

📖 Service Accounts in Firewall Rules - Identity-based firewall targeting using service accounts

📖 Implied and Pre-populated Rules - Understanding default deny and allow rules in VPC networks

Routes

📖 Routes Overview - How GCP routes traffic between subnets and external destinations

📖 Static Routes - Creating custom static routes for specific traffic patterns

📖 Dynamic Routes - Routes learned through Cloud Router and BGP peering

📖 Route Priority - Understanding route selection based on specificity and priority

📖 Next Hop Types - Instance, IP address, VPN tunnel, and internet gateway next hops

Shared VPC & VPC Peering

Shared VPC

📖 Shared VPC Overview - Connecting resources from multiple projects to a common VPC network

📖 Shared VPC Architecture - Design patterns for enterprise multi-project networking

📖 Setting up Shared VPC - Step-by-step configuration of host and service projects

📖 Shared VPC IAM Roles - Required permissions for host and service project administrators

📖 Shared VPC with GKE - Running Kubernetes clusters in Shared VPC environments

📖 Service Project Admin Best Practices - Delegating network administration in service projects

VPC Network Peering

📖 VPC Network Peering Overview - Connecting VPC networks across projects or organizations privately

📖 VPC Peering Configuration - Creating and managing peering connections between networks

📖 Peering Subnet Routes - Understanding automatic subnet route exchange in peered networks

📖 Peering Custom Routes - Importing and exporting custom routes across peering connections

📖 VPC Peering Limitations - Transitive peering restrictions and overlapping IP constraints

📖 Peering vs Shared VPC - Choosing the right multi-project networking approach

Hybrid Connectivity

Cloud VPN

📖 Cloud VPN Overview - Securely connecting on-premises networks to GCP via IPsec tunnels

📖 HA VPN - High availability VPN with 99.99% SLA and redundant tunnels

📖 Classic VPN - Legacy single-tunnel VPN solution (deprecated for new deployments)

📖 Creating HA VPN Gateways - Step-by-step HA VPN deployment with redundancy

📖 VPN Supported IKE Ciphers - Supported encryption algorithms and IKE versions

📖 VPN Topologies - Common VPN deployment patterns and architectures

📖 VPN with Dynamic Routing - Configuring BGP over VPN tunnels via Cloud Router

📖 VPN Monitoring and Logs - Monitoring VPN tunnel status and troubleshooting connectivity

Cloud Interconnect

📖 Cloud Interconnect Overview - Dedicated private connectivity between on-premises and GCP

📖 Dedicated Interconnect - Physical connections at Google colocation facilities (10 Gbps or 100 Gbps)

📖 Partner Interconnect - Connectivity through supported service providers (50 Mbps to 50 Gbps)

📖 Choosing Interconnect Options - Decision tree for selecting VPN, Dedicated, or Partner Interconnect

📖 VLAN Attachments - Configuring Layer 2 connections over Interconnect circuits

📖 Interconnect Pricing - Understanding attachment, egress, and port costs

📖 Interconnect Colocation Facilities - Finding available Google colocation points globally

📖 Interconnect SLA - Service level agreements for Interconnect availability

📖 Setting up Dedicated Interconnect - Complete deployment guide for dedicated connections

📖 Setting up Partner Interconnect - Provisioning partner-based connectivity

Cloud Router

📖 Cloud Router Overview - Managed BGP routing for dynamic route exchange with on-premises

📖 Cloud Router Configuration - Setting up BGP sessions and route advertisements

📖 BGP Route Advertisement - Controlling which routes are advertised to on-premises

📖 Custom Route Advertisement - Selectively advertising specific IP ranges via BGP

📖 Viewing Learned Routes - Monitoring routes learned from on-premises networks

📖 BFD for Cloud Router - Bidirectional Forwarding Detection for fast failover

Private Google Access

📖 Private Google Access Overview - Accessing Google APIs from VMs without external IP addresses

📖 Configuring Private Google Access - Enabling subnet-level private access to Google services

📖 Private Google Access for On-Premises - Accessing Google APIs from on-premises networks via VPN/Interconnect

📖 Private Service Connect - Consuming Google-managed or third-party services using internal IPs

📖 Private Service Connect for Google APIs - Accessing Google APIs through VPC endpoints

Load Balancing

Load Balancing Overview

📖 Cloud Load Balancing Overview - Introduction to GCP's global and regional load balancing portfolio

📖 Choosing a Load Balancer - Decision matrix for selecting the right load balancer type

📖 External vs Internal Load Balancing - Understanding external internet-facing and internal private load balancers

Application Load Balancer (HTTP/S)

📖 Application Load Balancer - Global HTTP(S) Layer 7 load balancing with content-based routing

📖 URL Maps - Defining traffic routing rules based on URL paths and hosts

📖 Backend Services - Configuring backend instance groups, NEGs, and health checks

📖 Backend Buckets - Serving static content from Cloud Storage via load balancer

📖 SSL Certificates - Managing SSL/TLS certificates for HTTPS load balancing

📖 SSL Policies - Configuring TLS versions and cipher suites for security compliance

📖 Cloud Armor Integration - Enabling DDoS protection and WAF rules on HTTP(S) load balancers

📖 Identity-Aware Proxy (IAP) with Load Balancing - Adding identity-based access control to load-balanced applications

Network Load Balancer

📖 Network Load Balancer Overview - Regional Layer 4 TCP/UDP pass-through load balancing

📖 External Network Load Balancer - Regional external TCP/UDP load balancing configurations

📖 Internal Network Load Balancer - Private internal TCP/UDP load balancing within VPC

📖 Session Affinity - Configuring client IP, cookie, or header-based session persistence

Proxy Network Load Balancer

📖 Proxy Network Load Balancer - Global TCP/SSL proxy load balancing for non-HTTP traffic

📖 SSL Proxy Load Balancer - Global SSL/TLS termination for encrypted non-HTTP protocols

📖 TCP Proxy Load Balancer - Global TCP proxy for worldwide application access

Advanced Load Balancing Features

📖 Health Checks - Configuring automated backend health monitoring and failure detection

📖 Health Check Intervals - Understanding check frequency, timeout, and threshold settings

📖 Traffic Distribution Algorithms - Round robin, weighted, and connection-based distribution modes

📖 Connection Draining - Gracefully removing backends from service without dropping connections

📖 Custom Request Headers - Adding or modifying HTTP headers at the load balancer

📖 Outlier Detection - Automatically removing unhealthy backends based on error rates

Network Services

Cloud CDN

📖 Cloud CDN Overview - Global content delivery network for accelerating application content

📖 Enabling Cloud CDN - Configuring CDN with Cloud Storage backends

📖 Cache Modes - CACHE_ALL_STATIC, USE_ORIGIN_HEADERS, and FORCE_CACHE_ALL modes

📖 Cache Keys - Customizing cache keys based on host, protocol, query string

📖 Signed URLs and Signed Cookies - Controlling access to cached content with time-limited tokens

📖 Cache Invalidation - Purging cached content before TTL expiration

📖 Negative Caching - Caching error responses to reduce origin load

📖 Media CDN - Next-generation CDN optimized for media and large files

Cloud NAT

📖 Cloud NAT Overview - Managed network address translation for outbound internet access

📖 Cloud NAT Architecture - Understanding NAT gateway implementation and scaling

📖 Setting up Cloud NAT - Creating NAT gateways for specific regions and subnets

📖 NAT IP Addresses - Automatic and manual NAT IP address allocation

📖 Port Allocation - Understanding port allocation limits and scaling

📖 NAT Logging - Enabling logs for NAT translation events and troubleshooting

Cloud DNS

📖 Cloud DNS Overview - Scalable, reliable managed DNS hosting service

📖 Managed Zones - Creating public and private DNS zones

📖 Private DNS Zones - Internal DNS resolution for VPC resources

📖 DNS Peering - Sharing DNS configuration across VPC networks

📖 Split-Horizon DNS - Different responses for internal vs external queries

📖 DNSSEC - Enabling DNS Security Extensions for zone signing

📖 Cloud DNS Policies - Creating inbound and outbound server policies for hybrid DNS

Network Security

Cloud Armor

📖 Cloud Armor Overview - DDoS protection and Web Application Firewall for HTTP(S) load balancers

📖 Security Policies - Creating and managing Cloud Armor security rules

📖 Preconfigured WAF Rules - OWASP Top 10 protection, SQL injection, and XSS mitigation

📖 Custom Rules with CEL - Writing custom security rules using Common Expression Language

📖 Rate Limiting - Throttling excessive requests per client IP

📖 Adaptive Protection - Machine learning-based DDoS attack detection and mitigation

📖 Bot Management - Identifying and blocking malicious bot traffic

📖 Preview Mode - Testing security rules without enforcing blocks

Identity-Aware Proxy

📖 Identity-Aware Proxy Overview - Centralized authentication and authorization for applications

📖 Enabling IAP - Setting up IAP for Compute Engine, GKE, and App Engine

📖 IAP Policies - Controlling access with IAM roles and conditions

📖 IAP TCP Forwarding - Secure SSH and RDP access without bastion hosts

📖 Context-Aware Access - Enforcing access policies based on device and network attributes

VPC Service Controls

📖 VPC Service Controls Overview - Creating security perimeters around Google Cloud resources

📖 Service Perimeters - Defining resource boundaries to prevent data exfiltration

📖 Access Levels - Defining contextual access criteria for perimeter bridges

📖 Supported Services - List of GCP services that can be protected by perimeters

📖 Dry Run Mode - Testing perimeter policies without enforcement

SSL/TLS Security

📖 Certificate Manager - Centralized SSL/TLS certificate provisioning and management

📖 Google-Managed SSL Certificates - Automated certificate provisioning and renewal

📖 Self-Managed SSL Certificates - Uploading custom certificates to GCP

📖 mTLS Authentication - Mutual TLS authentication for client certificate validation

Packet Mirroring

📖 Packet Mirroring Overview - Cloning network traffic for security analysis and monitoring

📖 Setting up Packet Mirroring - Configuring mirroring policies and collectors

📖 Mirroring Filters - Selective traffic capture based on source, destination, and protocol

Network Monitoring & Troubleshooting

Network Intelligence Center

📖 Network Intelligence Center Overview - Comprehensive network monitoring and troubleshooting platform

📖 Network Topology - Visualizing VPC network architecture and connectivity

📖 Connectivity Tests - Testing reachability between endpoints and diagnosing issues

📖 Performance Dashboard - Monitoring packet loss, latency, and throughput metrics

📖 Firewall Insights - Analyzing firewall rule usage and identifying misconfigurations

Flow Logs

📖 VPC Flow Logs Overview - Network traffic sampling for analysis, auditing, and forensics

📖 Enabling Flow Logs - Configuring flow log sampling and aggregation intervals

📖 Flow Logs Metadata - Understanding logged fields and information available

📖 Analyzing Flow Logs - Querying logs in Cloud Logging and BigQuery

Cloud Monitoring

📖 Monitoring Network Metrics - Available network metrics for VPC, load balancers, and VPN

📖 Network Alerting - Creating alerts for network anomalies and threshold violations

📖 Custom Dashboards - Building network monitoring dashboards with Cloud Monitoring

Troubleshooting Tools

📖 Troubleshooting VPC Connectivity - Common connectivity issues and resolution steps

📖 Testing VPN Connectivity - Diagnosing VPN tunnel and routing problems

📖 Load Balancer Troubleshooting - Common load balancer issues and debugging techniques

📖 DNS Troubleshooting - Resolving Cloud DNS configuration and resolution issues

IP Addressing & DNS

IP Address Management

📖 IP Addresses Overview - Internal, external, ephemeral, and static IP addressing

📖 Reserving Static IP Addresses - Creating persistent external IP addresses

📖 Internal IP Address Reservation - Reserving specific internal IPs within subnets

📖 Bring Your Own IP (BYOIP) - Importing your own public IP address ranges to GCP

📖 IP Address Pricing - Understanding costs for static and ephemeral IP addresses

IPv6 Support

📖 IPv6 in VPC - Enabling dual-stack IPv4/IPv6 networking

📖 IPv6 Subnet Ranges - Configuring IPv6 CIDR blocks for subnets

📖 IPv6 External Addresses - Assigning IPv6 addresses to VM instances

Advanced Networking

Network Endpoint Groups (NEGs)

📖 Network Endpoint Groups Overview - Logical groupings of backend endpoints for load balancers

📖 Zonal NEGs - IP:port endpoint groups within specific zones

📖 Internet NEGs - Routing traffic to endpoints outside GCP

📖 Serverless NEGs - Load balancing to Cloud Run, App Engine, and Cloud Functions

📖 Hybrid Connectivity NEGs - Routing to on-premises endpoints via VPN/Interconnect

Traffic Director

📖 Traffic Director Overview - Service mesh traffic management for microservices

📖 Traffic Director Architecture - Control plane for Envoy-based service proxies

📖 Traffic Splitting - Weighted routing and canary deployments

Network Service Tiers

📖 Network Service Tiers Overview - Premium vs Standard tier network routing

📖 Premium Tier - Google's global network for lowest latency and highest reliability

📖 Standard Tier - Regional internet routing for cost optimization

📖 Choosing Network Tiers - Performance vs cost trade-offs

Private Google Access Variants

📖 Private Google Access Variants - Different methods for accessing Google APIs privately

📖 Private Google Access for Services - VPC-native access to Google services

📖 Serverless VPC Access - Connecting Cloud Run and Cloud Functions to VPC networks

Advanced Security Features

📖 Binary Authorization for Borg - Container deployment security policies

📖 Organization Policy Constraints - Network configuration guardrails at organization level

📖 VPC Flow Logs to BigQuery - Long-term retention and analysis of network flows

Exam Preparation Resources

Official Google Resources

📖 Google Cloud Skills Boost - Official hands-on labs and learning paths

📖 Network Engineer Learning Path - Curated courses and labs for certification preparation

📖 Google Cloud Documentation - Comprehensive product documentation

📖 Google Cloud Blog - Networking - Latest networking features and best practices

📖 Google Cloud Architecture Center - Reference architectures and design patterns

Practice and Labs

📖 Qwiklabs - Networking Quests - Hands-on networking labs

📖 GCP Free Tier - Always free resources for practice environments

📖 Coursera - Networking in Google Cloud - Official training courses

Quick Reference Commands

gcloud Network Commands

# VPC and Subnet Management
gcloud compute networks create NETWORK_NAME --subnet-mode=custom
gcloud compute networks subnets create SUBNET_NAME --network=NETWORK_NAME --region=REGION --range=CIDR

# Firewall Rules
gcloud compute firewall-rules create RULE_NAME --network=NETWORK_NAME --allow=tcp:80,tcp:443
gcloud compute firewall-rules list --filter="network:NETWORK_NAME"

# VPC Peering
gcloud compute networks peerings create PEERING_NAME --network=NETWORK_NAME --peer-network=PEER_NETWORK

# Cloud Router
gcloud compute routers create ROUTER_NAME --network=NETWORK_NAME --region=REGION --asn=ASN
gcloud compute routers add-bgp-peer ROUTER_NAME --peer-name=PEER_NAME --peer-asn=PEER_ASN

# Cloud NAT
gcloud compute routers nats create NAT_NAME --router=ROUTER_NAME --auto-allocate-nat-external-ips

# Load Balancer Backend Services
gcloud compute backend-services create BACKEND_NAME --protocol=HTTP --health-checks=HEALTH_CHECK

# Cloud VPN
gcloud compute vpn-gateways create VPN_GATEWAY_NAME --network=NETWORK_NAME --region=REGION

# Interconnect
gcloud compute interconnects attachments create ATTACHMENT_NAME --router=ROUTER_NAME --region=REGION

# Cloud DNS
gcloud dns managed-zones create ZONE_NAME --dns-name=example.com --description="My DNS zone"
gcloud dns record-sets create www.example.com --zone=ZONE_NAME --type=A --ttl=300 --rrdatas=1.2.3.4

# Network Intelligence
gcloud network-management connectivity-tests create TEST_NAME --source-instance=SOURCE --destination-ip=DEST_IP

Key Networking Concepts

Network Latency & Performance

Latency Optimization: - Use Premium Network Tier for global applications - Deploy resources in multiple regions close to users - Enable Cloud CDN for static content - Use HTTP/2 and connection multiplexing - Optimize backend response times

Bandwidth Optimization: - Right-size interconnect connections - Use compression for HTTP traffic - Implement efficient caching strategies - Monitor and optimize egress costs - Use internal IPs for intra-region traffic

High Availability Patterns

Multi-Zone Deployments: - Distribute instances across zones - Use regional managed instance groups - Configure health checks appropriately - Implement graceful connection draining - Test failover scenarios regularly

Multi-Region Architectures: - Global load balancing for traffic distribution - Regional backend services for isolation - Cross-region VPN or Interconnect - DNS-based failover strategies - Data replication considerations

Cost Optimization

Network Cost Reduction: - Use internal IPs for intra-region communication - Minimize egress to internet - Choose appropriate network tier (Premium vs Standard) - Right-size interconnect bandwidth - Optimize NAT IP allocation

Load Balancer Cost Optimization: - Consolidate forwarding rules where possible - Use instance groups instead of instance targets - Implement efficient health check intervals - Consider regional vs global load balancing needs

Exam Tips & Strategies

Domain-Specific Focus

VPC Design (26% of exam): - Master subnet sizing and CIDR planning - Understand Shared VPC vs VPC Peering use cases - Know firewall rule evaluation order - Practice routing and next-hop scenarios

VPC Implementation (21% of exam): - Hands-on practice creating VPCs and subnets - Configure firewall rules with various targets - Set up private Google access - Implement alias IP ranges

Network Services (23% of exam): - Know all load balancer types and use cases - Understand Cloud CDN cache modes - Practice SSL certificate management - Configure Cloud NAT and Cloud DNS

Hybrid Connectivity (14% of exam): - Compare VPN, Dedicated Interconnect, Partner Interconnect - Understand Cloud Router and BGP configuration - Know redundancy and failover patterns - Practice VPN troubleshooting

Network Security (16% of exam): - Master Cloud Armor rule configuration - Understand IAP and context-aware access - Know VPC Service Controls concepts - Practice packet mirroring setup

Common Exam Scenarios

Scenario-Based Questions: - Choose appropriate connectivity option (cost, latency, bandwidth) - Design multi-region network architecture - Troubleshoot connectivity issues - Optimize for performance or cost - Implement security requirements

Best Practices Questions: - Recommended firewall rule patterns - Load balancer selection criteria - HA/DR architecture patterns - Security hardening techniques - Monitoring and alerting strategies

Certification Value

Career Impact

Job Roles: - Cloud Network Engineer: $110,000 - $160,000 - Senior Network Architect: $130,000 - $200,000 - Cloud Infrastructure Engineer: $120,000 - $180,000 - Network Security Engineer: $115,000 - $175,000 - Solutions Architect (Networking): $125,000 - $190,000

Skills Validated: - Enterprise network design and implementation - Hybrid cloud connectivity expertise - Network security and compliance - Performance optimization and troubleshooting - Google Cloud platform expertise

Professional Development

Complementary Certifications: - Professional Cloud Architect - Professional Cloud Security Engineer - Cisco CCNP/CCIE Enterprise - CompTIA Network+ - AWS Certified Advanced Networking

Continuing Education: - Stay current with GCP networking announcements - Practice with new features in test environments - Participate in Google Cloud communities - Attend Google Cloud Next conference - Contribute to networking forums and discussions

Additional Resources

📖 GCP Network Engineer Exam Guide - Official detailed exam topics

📖 Google Cloud Networking Deep Dive - Technical blog posts and tutorials

📖 Network Reliability Engineering - Google's approach to network reliability

📖 Cloud OnBoard: Networking - Free virtual training sessions

This fact sheet contains 100 embedded documentation links to official Google Cloud documentation.

Last Updated: October 2024 Certification Validity: 2 years from passing Recertification: Required every 2 years