What's changed: Created Professional Cloud Network Engineer Chapter 6 (Domain 6 "Network security": Google Cloud Armor = edge/backend policies/WAF (SQLi/XSS/RFI)/advanced DDoS and Adaptive Protection/rate limiting/bot management/Threat Intelligence; Cloud NGFW/VPC firewall = strategy/hierarchical/effective policy/L7 inspection (Enterprise)/migration/rule criteria (priority/protocol/direction/source-destination)/logging/micro-segmentation (secure tags/SA/network tags)/tiers (Essentials/Standard/Enterprise); public Cloud NAT (auto-manual IP/static-dynamic ports); Secure Web Proxy; self-managed NVA (multi-NIC/internal LB next hop/policy-based routes)/out-of-band Network Security Integration/Packet Mirroring).
6.2Cloud NAT, Secure Web Proxy, and NVA / Packet Mirroring
Understand public Cloud NAT IP addressing (automatic/manual allocation) and static/dynamic port allocation, controlling egress with Secure Web Proxy, self-managed network virtual appliances (multi-NIC VMs/NGFW appliances) with an internal LB as next hop for HA routing, policy-based routes for HA multi-NIC VMs, out-of-band Network Security Integration, and Packet Mirroring to self-managed collectors.
This covers controlling egress and inserting third-party appliances/visibility. Govern egress with NAT and Secure Web Proxy, and insert inspection with NVAs and Packet Mirroring.
6.2.1Cloud NAT and Secure Web Proxy
For internet egress from VMs without external IPs, use public Cloud NAT. Choose NAT IPs by automatic allocation or manual allocation (when a fixed egress IP is required), and configure static port allocation and dynamic port allocation to avoid port exhaustion. To allowlist egress destinations by URL/SNI at the application layer, use Secure Web Proxy (SWP), governing "where egress is allowed" by policy. Map "egress without external IP = Cloud NAT" and "control egress destinations by URL/SNI = Secure Web Proxy."
6.2.2Network virtual appliances and Packet Mirroring
To inspect inter-VPC traffic with third-party NGFW appliances, insert multi-NIC VMs (multiple network interfaces) on the path. For availability, set an internal load balancer as a next hop to spread redundantly across HA appliances, and use policy-based routes to steer only specific traffic. Alternatively, use out-of-band Network Security Integration (visibility without inline placement) or Packet Mirroring to replicate traffic to self-managed collectors (e.g., IDS). Map "inline inspection = multi-NIC NVA + ILB next hop" and "analyze by replication, not inline = Packet Mirroring (out-of-band)."
Common: requirement → means. E.g., "egress from no-external-IP VMs" = public Cloud NAT; "fixed egress IP required" = manual NAT IP allocation; "allowlist egress destinations by URL/SNI" = Secure Web Proxy; "inspect east-west with a third-party FW (inline, HA)" = multi-NIC NVA + internal LB next hop; "analyze by replication via IDS without inline" = Packet Mirroring; "divert only specific traffic to inspection" = policy-based routes.
Watch the mix-ups: (1) Cloud NAT (general internet egress) vs Private Google Access (private to Google APIs) vs Secure Web Proxy (URL/SNI egress control) differ in purpose. (2) NAT port exhaustion is eased with static/dynamic port allocation. (3) Packet Mirroring is out-of-band (replication)—to block inline, insert an NVA on the path.
6.2.3Section summary
- Egress = public Cloud NAT (auto/manual IP, static/dynamic ports); URL/SNI control = Secure Web Proxy
- Inline inspection = multi-NIC NVA + internal LB next hop + policy-based routes
- Analyze by replication = Packet Mirroring (out-of-band, to self-managed collectors)
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. To let many VMs without external IPs make outbound internet calls, which is best?
Q2. To allowlist egress destinations by URL/SNI and block unwanted egress, which is best?
Q3. To insert third-party NGFW appliances inline and steer traffic redundantly across several for HA, which design?
Q4. To analyze traffic at a self-managed IDS collector by replicating it without inline placement, which is best?
Q5. To give Cloud NAT a fixed egress IP because an external partner must allowlist it, which setting?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.