Google Cloud Professional Cloud Network EngineerStudy guide

Understand network tiers (Premium/Standard), high availability/failover/DR/scale, DNS topology, load balancer selection, Shared VPC vs standalone, VPC peering and Network Connectivity Center, IP address management (subnets/IPv6/PUPI/non-RFC1918/Private NAT), global/regional dynamic routing, MTU, and IAM roles suited to network designs.

Understand hybrid connectivity (Dedicated/Partner Interconnect, Cloud VPN, SD-WAN), multicloud connectivity (Cloud VPN, Cross-Cloud Interconnect), Direct Peering vs Verified Peering Provider, cross-region HA/DR, hybrid DNS topology (forwarding/inbound policies/DNS peering), interconnect encryption (MACsec/HA VPN over Interconnect), and GKE network design (VPC-native, secondary ranges, private clusters, control-plane access).

Understand creating VPC resources (networks/subnets/firewall rules or policies), VPC Network Peering, Shared VPC creation and sharing subnets with service projects with IAM permissions, Private Google Access, VPC Service Controls perimeters, expanding subnet ranges, static/dynamic routing (Cloud Router), route priority and network tags, internal LB as a next hop, and policy-based routing.

Understand Network Connectivity Center spoke types (VPC/hybrid/producer), topologies (star/hub-and-spoke/mesh), Private NAT and PSC propagation, CIDR filters, VPC-native clusters (alias IPs), clusters with Shared VPC, private clusters and control-plane endpoints, authorized networks, DNS-based endpoints, Dataplane V2, SNAT/IP masquerade, network policies, and Pod/Service ranges.

Understand load balancer selection (internal/external, regional/global, application/proxy/passthrough), backend services and autoscaling (NEGs/managed instance groups), balancing mode/session affinity/serving capacity/URL maps/health checks/global access, GKE load balancing (Gateway/Ingress controllers, NEGs), and Application Load Balancer traffic management (splitting/mirroring/URL rewrites).

Understand Cloud CDN (supported origins = MIG/Cloud Storage buckets/Cloud Run, external backends (internet NEGs)/third-party storage, cache invalidation) and Cloud DNS (zones/records, migration, routing policies (geolocation/failover), DNSSEC, self-hosted DNS integration (forwarding/server policies), public/private zones and split-horizon, cross-project binding/DNS peering, external-DNS for GKE).

Understand Dedicated/Partner/Cross-Cloud Interconnect connections and VLAN attachments, layer-2 vs layer-3 differences, HA VPN over Cloud Interconnect, 99.9%/99.99% SLA topologies, site-to-site IPSec VPN (HA VPN to on-prem/to other VPCs, Classic VPN route-based/policy-based), and encryption options such as MACsec.

Understand Cloud Router BGP attributes (ASN, route priority/MED, link-local addresses, authentication), Bidirectional Forwarding Detection (BFD), custom-advertised/learned routes, VPC legacy/standard best-path selection, Network Connectivity Center hybrid spokes (VPN/VLAN attachments), site-to-site data transfer, router appliances (RAs), and solving transitivity issues.

Understand logging of network components with Google Cloud Observability (Cloud VPN/Cloud Router/VPC Service Controls/Cloud NGFW/Firewall Insights/VPC Flow Logs/Cloud DNS/Cloud NAT/Network Connectivity Center), monitoring networking metrics, draining/redirecting traffic with the Application Load Balancer, troubleshooting VPN/Interconnect/Cloud Router BGP, and investigating with VPC Flow Logs/firewall logs/Packet Mirroring.

Understand monitoring/troubleshooting with Network Intelligence Center: Network Topology (visualize throughput and traffic flows), Connectivity Tests (diagnose route/firewall misconfigurations), Performance Dashboard (packet loss and latency: Google-wide/project-scoped), Firewall Insights (monitor/improve rules), Network Analyzer (auto-detect failures/suboptimal configs/utilization warnings), and Flow Analyzer (evaluate traffic via VPC Flow Logs).

Understand Google Cloud Armor policies (edge/backend security policies, WAF (SQLi/XSS/RFI), advanced network DDoS and Adaptive Protection, rate limiting, bot management, Threat Intelligence) and Cloud NGFW/VPC firewall rules (firewall strategy, hierarchical firewall, effective policy, L7 inspection (NGFW Enterprise), migration from VPC rules, rule criteria (priority/protocol/direction/source/destination), firewall logging, micro-segmentation, NGFW tiers (Essentials/Standard/Enterprise)).

Understand public Cloud NAT IP addressing (automatic/manual allocation) and static/dynamic port allocation, controlling egress with Secure Web Proxy, self-managed network virtual appliances (multi-NIC VMs/NGFW appliances) with an internal LB as next hop for HA routing, policy-based routes for HA multi-NIC VMs, out-of-band Network Security Integration, and Packet Mirroring to self-managed collectors.