Professional Cloud Network EngineerDemo

A VPC-native GKE cluster using user-managed secondary IP ranges lets the administrator define the Pod and Service CIDRs, including /24 ranges. Enabling the private control-plane endpoint disables external control-plane access, and master authorized networks can allow the required on-premises source CIDRs. A network proxy provides a controlled path for administrative access while keeping the cluster endpoints off the public internet.

HTTP(S) health checks can target a specific request path and require an expected response string. A backend is considered healthy when it returns HTTP 200 and the expected string is found in the response body, so a stable health endpoint and known response content provide a reliable health signal.

A trusted upstream proxy causes origin.ip to contain the proxy’s address rather than the original internet client’s address. Configuring userIpRequestHeaders[] enables Cloud Armor to populate origin.user_ip from the client-IP header supplied by that proxy, so inIpRange(origin.user_ip, 'IP_RANGE_BLOCK') blocks the intended clients. A backend security policy is the appropriate policy type to attach to the backend service; edge security policies do not support origin.user_ip.

Global dynamic routing allows dynamically learned and advertised routes to be used across VPC regions. A Cloud Router BGP session’s base advertised priority becomes its MED value, and a lower MED has higher preference. Setting the Dedicated Interconnect VLAN attachments to 100 and the HA VPN to 20000 makes Dedicated Interconnect the preferred path while retaining HA VPN for failover; corresponding MED values on the on-premises routers maintain that preference in the opposite direction.

Cloud NGFW periodically creates an intermediate CA that the configured CA pool signs, so its Network Security service agent needs the roles/privateca.certificateRequester role. A TLS inspection policy must reference that CA pool, be attached through the firewall endpoint association for the VPC, and the applicable firewall policy rule must enable TLS inspection. A Certificate Manager trust config is optional.

A Cloud DNS forwarding zone for corp.example.com sends VPC DNS queries for the on-premises zone to its authoritative on-premises DNS servers. An inbound DNS server policy exposes the VPC’s Cloud DNS resolution service through internal entry-point IP addresses reachable over Cloud VPN, allowing on-premises DNS servers to forward gcp.example.com queries to the Cloud DNS private zone.

External protocol forwarding uses a target instance that references one VM and can use multiple external forwarding rules to map multiple external IP addresses to that VM. External protocol forwarding supports ESP traffic. Target pool-based load balancing supports only TCP and UDP traffic.

Cloud Armor network edge security policies protect VMs with public IP addresses and support matching a source IP address’s BGP autonomous system number with --network-src-asns. A deny rule using that parameter blocks connection attempts from the specified ASN.

HA VPN over Cloud Interconnect provides IPsec encryption between the on-premises network and the VPC. Each HA VPN tunnel has 3 Gbps of bandwidth, and Google recommends four tunnels for each 10-Gbps VLAN attachment, with eight tunnels across two attachments to preserve capacity during failover. Two HA VPN gateways per Dedicated Interconnect connection provide the tunnel capacity and redundant encrypted paths required. MACsec protects only the segment between the on-premises router and Google's edge router, so it is not end-to-end encryption to the VPC.

Hierarchical firewall policies are evaluated before VPC firewall rules, and a goto_next action delegates matching traffic to lower-level VPC rules. An organization-level ingress goto_next rule for corporate-network TCP port 25 permits only the selected VPCs to make the final allow decision, while the subsequent ingress deny rule for TCP port 25 from 0.0.0.0/0 blocks all other SMTP traffic. Hierarchical firewall policies Firewall policy evaluation order

VPC Network Peering provides private connectivity between VPC networks in separate projects while leaving each VPC administratively independent. It automatically exchanges private subnet routes, but it does not exchange firewall rules. Therefore, ingress firewall rules must allow traffic from the peer VPC’s subnet ranges in each direction. Shared VPC centralizes network administration and existing instances cannot simply be reconfigured to use its shared subnets.

GKE container-native load balancing uses GCE_VM_IP_PORT NEGs containing Pod endpoints, avoiding the additional NodePort and kube-proxy hops of instance-group backends. An Ingress backend can reference the Kubernetes Service port by its name, such as http-api, rather than a numeric port. Compute Engine backend-service named ports apply only to instance-group backends, not GCE_VM_IP_PORT NEGs.

VPC-native GKE uses the subnet’s primary IPv4 range for node addresses and secondary IP ranges for Pod addresses and, when using user-managed Service ranges, Service ClusterIP addresses. This provides native VPC routing for Pods and independently planned address capacity for the large Pod and Service populations.

Cloud Armor security policies protect services behind supported external load balancers and can filter requests by incoming source IP address or CIDR range. An allow rule for the traffic-scrubbing service’s addresses, with a default deny rule for all other traffic, ensures that only traffic delivered by that service reaches the load-balanced backend.

Cloud CDN cache invalidation accepts a URL-path wildcard. The pattern /folder-a/* invalidates all cached objects in that directory/prefix in a single invalidation request. Cloud Storage lifecycle rules manage stored objects rather than targeted CDN cache eviction.

Cross-Cloud Interconnect provides dedicated, high-bandwidth physical connectivity between Google Cloud and AWS and supports private connectivity between a Google Cloud VPC and AWS resources. It uses Cloud Router and BGP sessions over VLAN attachments to exchange routes; redundant connections can be provisioned for high availability.

VPC Service Controls creates a service perimeter around Google Cloud resources and supported services such as Cloud Storage. Including project XYZ and restricting storage.googleapis.com limits access across the perimeter, helping ensure that Cloud Storage data is accessible only from the trusted resources and networks within the perimeter. Private connectivity and ACLs do not by themselves impose this service-perimeter access boundary.

A Cloud DNS private forwarding zone in the Shared VPC host project can forward queries for the on-premises private domain to on-premises DNS servers, making it available to workloads that use the authorized Shared VPC network. Cloud DNS sends queries to on-premises forwarding targets from 35.199.192.0/19; advertising that prefix through Cloud Router over the Interconnect supplies the on-premises return path for DNS responses.

Bring Your Own IP preserves the existing public IP addresses, avoiding the need for customers to change hard-coded DNS records. Google Cloud requires ownership validation for an imported public advertised prefix; after validation and provisioning, Google Cloud can advertise the prefix and the addresses can be assigned to supported Compute Engine resources.

VPC firewall logging does not support the implied ingress deny rule, so RDP traffic denied by that implied rule produces no firewall log entry. A logging-enabled explicit deny-all rule at priority 65500 matches traffic not already allowed by the HTTP rule and records the denied RDP attempts.

Google Cloud alias IP ranges allow a VM network interface with a primary IP address from a subnet’s primary CIDR range to also use addresses from a secondary CIDR range on that same subnet. Configuring 172.16.45.0/24 as the alias range for instances in the 10.1.1.0/24 subnet provides addresses from both networks.

A Network Connectivity Center hub using star topology separates center and edge spoke route tables. Edge spokes can have routes to center spokes, but Network Connectivity Center prohibits edge-group routes that provide connectivity between different edge spokes. Making the inspection VPC a center spoke and App-A and App-B edge spokes therefore sends their default-routed traffic to the inspection VPC and prevents direct App-A-to-App-B routing. A static route in a VPC spoke can use an internal passthrough Network Load Balancer in another spoke as its next hop when the relevant NCC connectivity requirements are met.

A policy-based Classic VPN uses static routing, and static routes created with the Google Cloud CLI use the Cloud VPN tunnel as the next hop. The tunnel is specified by its name and region, rather than by the VPN gateway address or a remote instance address.

External HTTP(S) load balancers add a Via header to requests forwarded to the origin. Some web servers disable compression by default for proxied requests containing that header, so the web servers must be configured to compress responses even when a Via header is present.