Google Cloud Platform (GCP) Professional Cloud Network Engineer Certification Companion

Table of Contents
About the Author
About the Technical Reviewer
Acknowledgments
Introduction
Chapter 1: Exam Overview
Exam Content
Exam Subject Areas
Exam Format
Supplementary Study Materials
Sign Up for a Free Tier
Register for the Exam
Schedule the Exam
Rescheduling and Cancellation Policy
Exam Results
Retake Policy
Summary
Chapter 2: Designing, Planning, and  Prototyping a Google Cloud Network
Designing an Overall Network Architecture
High Availability, Failover, and Disaster Recovery Strategies
Disaster Recovery
High Availability
Service Level Indicator
Service Level Objective
Recovery Time Objective
Recovery Point Objective
Architecting Your Network for Resilience and High Availability
DNS (Domain Name System) Strategy
Using Hybrid DNS Resolution with Two Authoritative DNS Systems
Using Nonhybrid DNS Resolution
Security and Data Exfiltration Requirements
VPC Service Perimeter
Load Balancing
Applying Quotas per Project and per VPC
Container Networking
Google Kubernetes Engine
Planning IP Address Allocation for Services, Pods, and Nodes
Using VPC-Native Clusters
Using Container-Native Load Balancing
SaaS, PaaS, and IaaS Services
Designing Virtual Private Cloud (VPC) Instances
VPC Specifications
Subnets
IP Address Management and Bring Your Own IP (BYOIP)
External IP Addresses
Internal IP Addresses
Standalone vs. Shared VPC
Standalone
Shared
Multiple vs. Single
Single VPC in Single Host Project
Single Shared VPC with Multiple Service Projects
Multiple Shared VPCs with Multiple Service Projects
Regional vs. Multi-regional
VPC Network Peering
Examples
Firewalls
Example
Custom Routes
Designing a Hybrid and Multi-cloud Network
Drivers for Hybrid and Multi-cloud Networks
Business Requirements
Development Requirements
Operational Requirements
Architectural Requirements
Overall Goals
Designing a Hybrid and Multi-cloud Strategy
Dedicated Interconnect vs. Partner Interconnect
Direct vs. Carrier Peering
IPsec VPN
Bandwidth and Constraints Provided by Hybrid Connectivity Solutions
Cloud Router
VPC Routing
Cloud Router Overview
Multi-cloud and Hybrid Topologies
Mirrored
Meshed
Gated Egress
Gated Ingress
Gated Ingress and Egress
Handover
Regional vs. Global VPC Routing Mode
Failover and Disaster Recovery Strategy
High Availability (HA) VPN
Redundant VPC
Accessing Google Services/APIs Privately from On-Premises Locations
Private Google Access
Private Service Connect
IP Address Management Across On-Premises Locations and Cloud
Designing an IP Addressing Plan for Google Kubernetes Engine (GKE)
GKE VPC-Native Clusters
Optimizing GKE IP Ranges
Flexible Pod Density
Expanding GKE IP Ranges
Non-RFC 1918
Privately Used Public IP (PUPI)
Public and Private Cluster Nodes
Control Plane Public vs. Private Endpoints
Private Cluster with Disabled Public Endpoint
Private Cluster with Limited Public Endpoint Access
Private Cluster with Unlimited Public Endpoint Access
Summary
Exam Questions
Question 2.1 (VPC Peering)
Rationale
Question 2.2 (Private Google Access)
Rationale
Chapter 3: Implementing Virtual Private Cloud Instances
Configuring VPCs
Configuring VPC Resources
Creating VPCs
Creating Subnets
Listing Subnets
Listing VPCs
Deleting VPCs
Configuring VPC Peering
Creating a Shared VPC and Sharing Subnets with Other Projects
Host and Service Project Concepts
Shared VPC Deep Dive
Assigning Roles to Principals
Creating the Shared VPC
Creating the Service Projects
Enabling Compute API for Service and Host Projects
Enabling Host Project
Attaching Service Projects
Assigning Individual Subnet-Level Roles to Service Project Admins
Using a Shared VPC
Listing Usable Subnets
Creating VMs
Verifying VM Connectivity
Deleting VMs
Shared VPC Summary
Sharing Subnets Using Folders
Configuring API Access to Google Services (e.g., Private Google Access, Public Interfaces)
Configuring Private Google Access (PGA)
Configuring Private Service Connect (PSC)
Expanding VPC Subnet Ranges After Creation
Configuring Routing
Static vs. Dynamic Routing
Static Routes
Dynamic Routes
Routing Order
Global vs. Regional Dynamic Routing
Viewing Inter-region Routes Programmed by a Cloud Router
Updating the Base Priority for Advertised Routes
Routing Policies Using Tags and Priorities
Internal Load Balancer As a Next Hop
Custom Route Import/Export over VPC Peering
Configuring and Maintaining Google Kubernetes Engine Clusters
VPC-Native Clusters Using Alias IP Ranges
Clusters with Shared VPC
Clusters with Shared VPC Deep Dive
Enabling Container API for Service and Host Projects
Assigning Subnet-Level Roles to Service Accounts
Assigning Host Service Agent User Role to GKE Service Accounts
Listing Usable Subnets
Creating GKE Clusters
Testing Connectivity
Deleting GKE Clusters
Creating Cluster Network Policies
Cloning the GKE Sample Apps from GitHub
Creating a Network Policy–Enabled GKE Cluster
Restricting Ingress Traffic
Validating Ingress Network Policy
Restricting Egress Traffic
Validating Egress Network Policy
Deleting the Cluster
Additional Guidelines
Private Clusters and Private Control Plane Endpoints
Adding Authorized Networks for Cluster Control Plane Endpoints
Configuring and Managing Firewall Rules
Target Network Tags and Service Accounts
Syntax for Creating Firewall Rules
Priority
Example
Protocols and Ports
Direction
Example
Firewall Rule Logs
Firewall Rule Summary
Exam Questions
Question 3.1 (Routing)
Rationale
Question 3.2 (Firewall Rules)
Rationale
Question 3.3 (Firewall Rules, VPC Flow Logs)
Rationale
Question 3.4 (Firewall Rules, Target Network Tags)
Rationale
Chapter 4: Implementing Virtual Private Cloud Service Controls
VPC Service Controls Introduction
Creating and Configuring Access Levels and Service Perimeters
Perimeters
Access Levels
Service Perimeter Deep Dive
Enabling Access Context Manager and Cloud Resource Manager APIs
Creating an Access Policy for the Organization
Creating an Access Level
Creating a Perimeter
Testing the Perimeter
Deleting the Buckets
VPC Accessible Services
Perimeter Bridges
Audit Logging
Dry-Run Mode
Dry-Run Concepts
Perimeter Dry-Run
Setting Up Private Connectivity to Google APIs
Updating the Access Level
Updating the Perimeter
Testing the Perimeter
Creating a Perimeter Dry-Run by Limiting VPC Allowed Services
Testing the Perimeter Dry-Run
Enforcing the Perimeter Dry-Run
Testing the Enforced Perimeter
Cleaning Up
Final Considerations
Shared VPC with VPC Service Controls
VPC Peering with VPC Service Controls
Exam Questions
Question 4.1 (Perimeter with Shared VPC)
Rationale
Question 4.2 (Dry-Run)
Rationale
Chapter 5: Configuring Load Balancing
Google Cloud Load Balancer Family
Backend Services and Network Endpoint Groups (NEGs)
Configuring Managed Instance Groups (MIGs)
Configuring a Zonal Network Endpoint Group (NEG)
Firewall Rules to Allow Traffic and Health Checks to Backend Services
Configuring External HTTP(S) Load Balancers Including Backends and Backend Services with Balancing Method, Session Affinity, and Capacity Scaling/Scaler
Modes of Operation
Architecture
Forwarding Rule
Target HTTP(S) Proxy
Multiple SSL Certificates
Self-Managed and Google-Managed SSL Certificates
SSL Policies
URL Map
Backend Service
Backends
Container-Native Global HTTP(S) Load Balancing Deep Dive
Container-Native Load Balancing Through Ingress
Container-Native Load Balancing Through Standalone Zonal NEGs
Global HTTP(S) Load Balancing with Managed Instance Groups
External TCP and SSL Proxy Load Balancers
External SSL Proxy Load Balancer
External TCP Proxy Load Balancer
Network Load Balancers
Examples
Implementation
Internal HTTP(S) and TCP Proxy Load Balancers
Load Balancer Summary
Protocol Forwarding
Accommodating Workload Increases Using Autoscaling vs. Manual Scaling
Configuring Cloud Armor Policies
Security Policies
Adaptive Protection
Web Application Firewall (WAF) Rules
Configure Custom Rules Language Attributes
Attaching Security Policies to Backend Services
Example
Configuring Cloud CDN
Interaction with HTTP(S) Load Balancer
Enabling and Disabling Cloud CDN
Cacheable Responses
Using Cache Keys
Customizing Cache Keys
Enabling Cloud CDN
Updating Cache Keys to Remove Protocol, Host, and Query String
Updating Cache Keys to Add Protocol, Host, and Query String
Updating Cache Keys to Use an Include or Exclude List of Query Strings
Updating Cache Keys to Use HTTP Headers
Updating Cache Keys to Use Named Cookies
Cache Invalidation
Path Pattern
Invalidating a Single File
Invalidate the Whole Directory
Invalidate Everything
Signed URLs
Configuring Signed Request Keys
Signing URLs
Custom Origins
Specifying a Custom Origin
Best Practices
Use TLS Everywhere
Restrict Ingress Traffic with Cloud Armor and Identity-Aware Proxy (IAP)
Enable Cloud CDN for Cacheable Content
Enable HTTP/2 As Appropriate
Optimize Network for Performance or Cost Based on Your Requirements
Leverage User-Defined HTTP Request Headers to Manage Metadata
Exam Questions
Question 5.1 (Backend Services)
Rationale
Question 5.2 (Backend Services, Max CPU %, Capacity)
Rationale
Question 5.3 (Backend Services, Canary A/B Testing)
Rationale
Question 5.4 (HTTPS Load Balancer, Cloud CDN)
Rationale
Question 5.5 (HTTPS Load Balancer, Autoscale)
Rationale
Chapter 6: Configuring Advanced Network Services
Configuring and Maintaining Cloud DNS
Managing Zones and Records
Creating Public Zones
Creating Private Zones
Creating Forwarding Zones
Creating Peering Zones
Managing Records
Migrating to Cloud DNS
Create a Managed Zone for Your Domain
Export the DNS Configuration from Your Existing Provider
Import Your Existing DNS Configuration to Cloud DNS
Verify the Migration
Update Your Registrar's Name Server Records
Wait for Changes and Then Verify
DNS Security Extensions (DNSSEC)
Forwarding and DNS Server Policies
Inbound Server Policy
Outbound Server Policy
Integrating On-Premises DNS with Google Cloud
Approach 1: Keep DNS Resolution On-Premises
Approach 2: Move DNS Resolution to Cloud DNS
Approach 3 (Recommended): Use a Hybrid Approach with Two Authoritative DNS Systems
Split-Horizon DNS
Split-Horizon Use Cases
DNS Peering
Understanding the Cloud DNS Peering Solution
Private DNS Logging
Configuring Cloud NAT
Architecture
Creating a Cloud NAT Instance
Addressing and Port Allocations
Static Port Allocation
Dynamic Port Allocation
Customizing Timeouts
Logging and Monitoring
Enabling Cloud NAT Logging
Filtering NAT Logs
Verifying NAT Logging Status
Viewing NAT Logs
Monitoring
Restrictions per Organization Policy Constraints
Configuring Network Packet Inspection
Configuring Packet Mirroring
Packet Mirroring in Single and Multi-VPC Topologies
Mirrored Sources and Collector Instances Located in the Same VPC
Mirrored Sources and Collector Instances Located in Peered VPCs
Collector Instances Located in Shared VPC Service Project
Collector Instances Located in Shared VPC Host Project
Mirror Sources and Collector Instances Using Multi-NIC VMs
Capturing Relevant Traffic Using Packet Mirroring Source and Traffic Filters
Routing and Inspecting Inter-VPC Traffic Using Multi-NIC VMs (e.g., Next-Generation Firewall Appliances)
Configuring an Internal Load Balancer As a Next Hop for Highly Available Multi-NIC VM Routing
Configuring the Networks
Configuring the Firewall Rules
Creating the Common Managed Instance Group (MIG)
Creating the Forwarding Rules
Creating the Custom Static Routes That Define the Load Balancers As the Next Hops
Creating the First VM
Creating the Second VM
Verifying Load Balancer Health Status
Testing Connectivity from the Testing VM
Testing Connectivity from the Production VM
Exam Questions
Question 6.1 (Cloud DNS)
Rationale
Question 6.2 (Cloud NAT)
Rationale
Question 6.3 (Cloud DNS)
Rationale
Chapter 7: Implementing Hybrid Connectivity
Configuring Cloud Interconnect
Dedicated Interconnect Connections and VLAN Attachments
Prerequisites
How It Works
VLAN Attachments
Configuring Dedicated Interconnect
Ordering a Dedicated Interconnect Connection
Retrieving LOA-CFAs
Testing a Single-Circuit Connection (One 10 Gbps or 100 Gbps Circuit)
Creating a VLAN Attachment
Configuring On-Premises Devices
Partner Interconnect Connections and VLAN Attachments
Prerequisites
How It Works
VLAN Attachments
Configuring Partner Interconnect
Establishing Connectivity with a Supported Service Provider (Partner)
Creating a VLAN Attachment
Ordering a Connection to Google Cloud
Activating Your Connection
Configuring On-Premises Devices
Configuring a Site-to-Site IPsec VPN
High Availability VPN (Dynamic Routing)
How It Works
Configuring an HA VPN Gateway and a Tunnel Pair to a Peer VPN Gateway
Creating an HA VPN Gateway
Creating a Peer VPN Gateway Resource
Creating a Cloud Router
Creating IPsec Tunnels
Establishing BGP Sessions
Configure On-Premises Devices
Classic VPN (e.g., Route-Based Routing, Policy-Based Routing)
Policy-Based Routing
Route-Based Routing
Configuring Cloud Router
Border Gateway Protocol (BGP) Attributes (e.g., ASN, Route Priority/MED, Link-Local Addresses)
Autonomous System Number (ASN)
Route Priorities and Multi-exit Discriminators (MEDs)
BGP Peering IP Addresses
IPv6 Support
Default Route Advertisements via BGP
Custom Route Advertisements via BGP
Deploying Reliable and Redundant Cloud Routers
Resilience
Reliability
High Availability
Security
Exam Questions
Question 7.1 (Interconnect Attachments)
Rationale
Question 7.2 (Cloud VPN)
Rationale
Question 7.3 (Cloud VPN)
Rationale
Question 7.4 (Partner Interconnect)
Rationale
Question 7.5 (Cloud Router)
Rationale
Chapter 8: Managing Network Operations
Logging and Monitoring with Google Cloud’s Operations Suite
Reviewing Logs for Networking Components (e.g., VPN, Cloud Router, VPC Service Controls)
Cloud Logging
Log Types
Cloud Logging Deep Dive
Monitoring Networking Components (e.g., VPN, Cloud Interconnect Connections and Interconnect Attachments, Cloud Router, Load Balancers, Google Cloud Armor, Cloud NAT)
Cloud Monitoring
Cloud Monitoring Deep Dive
Managing and Maintaining Security
Firewalls (e.g., Cloud-Based, Private)
Network Firewall Policies
Diagnosing and Resolving IAM Issues (e.g., Shared VPC, Security/Network Admin)
Policy Troubleshooter
Maintaining and Troubleshooting Connectivity Issues
Draining and Redirecting Traffic Flows with HTTP(S) Load Balancing
How It Works
Enabling Connection Draining
Monitoring Ingress and Egress Traffic Using VPC Flow Logs
How It Works
Enabling VPC Flow Logs
Cost Considerations
Viewing Flow Logs
Monitoring Firewall Logs and Firewall Insights
Firewall Rules Logging
Firewall Insights
Managing and Troubleshooting VPNs
Troubleshooting Cloud Router BGP Peering Issues
BGP Session Failed to Establish
IP Addresses for BGP Sessions
Invalid Value for the Field resource.bgp.asn
iBGP Between Cloud Routers in a Single Region Doesn't Work
Monitoring, Maintaining, and Troubleshooting Latency and Traffic Flow
Testing Latency and Network Throughput
Using Network Intelligence Center to Visualize Topology, Test Connectivity, and Monitor Performance
Exam Questions
Question 8.1 (VPC Flow Logs, Firewall Rule Logs)
Rationale
Question 8.2 (Firewall Rule Logs)
Rationale
Question 8.3 (IAM)
Rationale
Question 8.4 (IAM)
Rationale
Question 8.5 (Troubleshooting VPN)
Rationale
Index