What's changed: Created Professional Cloud Network Engineer Chapter 1 (Domain 1 "Design and plan": network tiers/HA/DR/scale/Shared VPC/VPC peering/Network Connectivity Center/IAM; IPAM/subnets/IPv6/PUPI/Private NAT/DNS topology/global-regional dynamic routing/MTU; hybrid-multicloud = Dedicated/Partner/Cross-Cloud Interconnect/HA VPN/Direct Peering/hybrid DNS/MACsec; GKE design = VPC-native/secondary ranges/private clusters/authorized networks).
1.1Overall network design and VPC design
Understand network tiers (Premium/Standard), high availability/failover/DR/scale, DNS topology, load balancer selection, Shared VPC vs standalone, VPC peering and Network Connectivity Center, IP address management (subnets/IPv6/PUPI/non-RFC1918/Private NAT), global/regional dynamic routing, MTU, and IAM roles suited to network designs.
A Professional Cloud Network Engineer designs Google Cloud networks for availability, scalability, resiliency, and security. The first decisions are the hard-to-reverse VPC and addressing design. The exam tests translating requirements into "which construct satisfies it."
1.1.1Overall architecture and network tiers
Choose egress path quality with network tiers. The Premium tier maximizes the Google backbone to route global users to the nearest edge (high quality); the Standard tier uses regional ISP egress for cost. Design high availability, failover, DR, and scale with regional redundancy, global LBs, and multiple paths. For consistent networking across projects use Shared VPC (a host project shares its VPC with service projects); interconnect separate VPCs with VPC Network Peering; and aggregate many networks into a hub with Network Connectivity Center (NCC). Scope network permissions to least privilege with IAM roles (e.g., Network Admin, Shared VPC subnet-user permission).
1.1.2IP address management, DNS, routing, and MTU
In IPAM (IP address management), plan non-overlapping subnets, IPv6, non-RFC1918 and PUPI (privately used public IP), BYOIP (bring your own IP), and Private NAT for egress SNAT without exhausting internal ranges. For managed-services connectivity, plan private services access (reach Google-managed services like Cloud SQL over VPC peering), Private Service Connect (private access to specific services), and Serverless VPC Access (reach into the VPC from serverless). For name resolution, design the DNS topology with on-prem and Cloud DNS public/private zones, split-horizon, and forwarding/peering. Decide route scope with the dynamic routing mode: regional (only same-region BGP routes) or global (propagated to all regions). Set the MTU (maximum transmission unit) correctly per workload to avoid fragmentation and connectivity issues. Also plan GKE design (secondary ranges; scale ceilings driven by IP space) up front.
Common: requirement → means. E.g., "route global users to nearest, high-quality path" = Premium tier; "cost-first egress" = Standard tier; "common VPC across projects" = Shared VPC; "connect separate VPCs" = VPC peering; "aggregate many networks into a hub" = Network Connectivity Center; "egress SNAT without using internal ranges" = Private NAT; "propagate routes to all regions" = global dynamic routing.
Watch the mix-ups: (1) Do not confuse Shared VPC (share one VPC) with VPC peering (connect separate VPCs). (2) Regional dynamic routing only learns/propagates same-region routes; use global to span all regions. (3) Premium/Standard tiers trade performance vs cost—Premium is the default.
1.1.3Section summary
- Path quality = network tiers (Premium quality / Standard cost); design HA/DR with redundancy and multiple paths
- Common network = Shared VPC; connect separate VPCs = peering; hub aggregation = Network Connectivity Center
- IPAM = non-overlapping subnets/Private NAT; set route scope via global/regional dynamic routing
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. To route global users via the Google backbone to the nearest edge with the highest-quality path, which network tier?
Q2. To let multiple service projects share a centrally managed common VPC, which is best?
Q3. To aggregate many VPCs and hybrid connections into a managed hub-and-spoke, which is best?
Q4. To propagate BGP routes learned by Cloud Router to subnets in all regions, which setting?
Q5. To provide SNAT addresses for many VMs' egress without consuming internal IP ranges, which is best?