What's changed: Created Professional Cloud Network Engineer Chapter 5 (Domain 5 "Operations": logging network components (VPN/Router/VPC SC/Cloud NGFW/Firewall Insights/VPC Flow Logs/Cloud DNS/Cloud NAT/NCC) with Google Cloud Observability, networking metrics monitoring, Application Load Balancer connection draining/traffic redirect, VPN/Interconnect/Cloud Router BGP troubleshooting, VPC Flow Logs/firewall logs/Packet Mirroring, Network Intelligence Center = Network Topology/Connectivity Tests/Performance Dashboard/Firewall Insights/Network Analyzer/Flow Analyzer).
5.1Logging/monitoring and connectivity troubleshooting
Understand logging of network components with Google Cloud Observability (Cloud VPN/Cloud Router/VPC Service Controls/Cloud NGFW/Firewall Insights/VPC Flow Logs/Cloud DNS/Cloud NAT/Network Connectivity Center), monitoring networking metrics, draining/redirecting traffic with the Application Load Balancer, troubleshooting VPN/Interconnect/Cloud Router BGP, and investigating with VPC Flow Logs/firewall logs/Packet Mirroring.
A production network depends on visibility. Capture logs and metrics for each component, and during incidents triage quickly with the right data.
5.1.1Logging and metrics monitoring
Use Google Cloud Observability (formerly Operations) to enable and review logs for each network component: Cloud VPN, Cloud Router, VPC Service Controls, Cloud NGFW, Firewall Insights, VPC Flow Logs, Cloud DNS, Cloud NAT, Network Connectivity Center, and more. VPC Flow Logs record samples of VM-to-VM/external traffic for investigation and billing analysis. With metrics, monitor the state of Cloud VPN/Interconnect, VLAN attachments, Cloud Router, load balancers, Google Cloud Armor, and Cloud NAT (tunnel up, BGP session, throughput, drops) and alert on thresholds. Map "record of who talked to what = VPC Flow Logs" and "monitor tunnel/BGP health = VPN/Router metrics."
5.1.2Connectivity troubleshooting and traffic control
For maintenance, use Application Load Balancer connection draining to let existing connections finish before removing a backend, and redirect traffic (reweight/to another region) to avoid impact. To troubleshoot, triage in order: VPN tunnels/IKE, Cloud Interconnect links/VLAN attachments, and Cloud Router BGP peering (session establishment, route advertisement). Investigate at packet level with VPC Flow Logs, firewall logs, and Packet Mirroring (traffic replication). Map "drain a backend without dropping connections = draining" and "BGP won't come up = check ASN/auth/advertisements."
Common: requirement → means. E.g., "record VM-to-VM traffic for investigation" = VPC Flow Logs; "replicate a VM's traffic for deep analysis" = Packet Mirroring; "remove a backend without dropping connections" = connection draining; "check if a firewall blocked it" = firewall logs; "BGP session not establishing" = check Cloud Router ASN/auth/advertisements.
Watch the mix-ups: (1) VPC Flow Logs are sampled—not every packet (use Packet Mirroring for precise analysis). (2) Firewall logging must be explicitly enabled per rule or nothing is logged. (3) Draining "stops new connections and finishes existing ones"—it is not an instant cutoff.
5.1.3Section summary
- Capture logs/metrics for network components via Cloud Observability (VPN/Router/NAT/NGFW/Flow Logs)
- Investigate = VPC Flow Logs (sampled)/firewall logs/Packet Mirroring (replication)
- Zero-impact maintenance = connection draining + redirect; BGP issues = check ASN/auth/advertisements
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. To record VM-to-VM and external traffic for security investigation and network-usage analysis, which is best?
Q2. To fully replicate a specific VM's packets to an external collector (IDS/IPS) for deep analysis, which is best?
Q3. To remove a backend for maintenance without dropping existing connections while stopping new ones, which Application LB feature?
Q4. Routes are not propagating to on-prem over HA VPN. What should you check first in Cloud Router BGP?
Q5. To verify whether specific traffic was allowed or denied by a firewall, what is the prerequisite?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.