Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!
Gauge your current knowledge
Gauge your current knowledge
To meet strict Service Level Agreements (SLAs), you need a highly available hybrid network. Google recommends using four Cloud Interconnect connections across two different Google Cloud regions. This design, which can mix Dedicated Interconnect and Partner Interconnect, provides a 99.99% availability guarantee. A common way to manage these connections is a Hub-and-Spoke topology, where a central hub VPC connects to many spoke VPCs and the on-premises network. For the most critical systems, a Hot HA pattern keeps both cloud and on-premises sites active, using Cloud Router and BGP to automatically failover traffic if one site fails. Cloud DNS is also key for smooth operations, using peering and forwarding zones so systems on either side can find each other.
Cloud Interconnect provides private connectivity between your on-premises network and Google Cloud. Dedicated Interconnect is a direct physical link requiring your equipment to be in a Google-supported colocation facility; it's best for very high bandwidth needs. Partner Interconnect connects through a supported service provider, offering more flexible locations and is good when you can't reach a Google facility directly. Both use a Cloud Router to manage dynamic routing with BGP, which automatically exchanges route information between your networks. For extra security, you can add HA VPN over Cloud Interconnect for encryption.
Cloud VPN creates encrypted tunnels over the public internet to connect on-premises networks to Google Cloud. For professional use, High Availability (HA) VPN is preferred, as it sets up two tunnels for 99.99% availability. It integrates with Cloud Router using BGP for dynamic routing, allowing the network to learn paths automatically and failover without manual help. Cloud VPN is often used in hub-and-spoke or Shared VPC designs, where a central hub manages the connection for many spokes. Setting it up requires matching Pre-Shared Keys (PSK) and encryption settings on both ends, along with proper firewall rules and route advertisements.
To connect different Google Cloud projects or organizations, you use VPC Network Peering for direct internal connections or Shared VPC for centralized network management. Private Service Connect lets services be accessed through a private endpoint in a consumer's VPC, useful for reaching Google APIs or third-party services without external IPs. For larger multicloud setups, Network Connectivity Center acts as a central hub to manage connections between VPCs, on-premises data centers, and other clouds. Security is reinforced by VPC Service Controls, which create a security perimeter to prevent data leakage, and Cloud Service Mesh, which uses identity and encryption for secure service-to-service communication.
Cloud Router manages dynamic routing within your VPC and to external networks using BGP, automating path updates. High Availability (HA) VPN provides secure connections to other clouds or on-premises, requiring two tunnels for its 99.99% SLA. Cloud NAT allows resources without external IPs to access the internet while blocking incoming connections, and it can be configured with manual IPs for specific allowlisting needs. In complex multicloud architectures, a Transit VPC can act as a central traffic hub, allowing you to place Network Virtual Appliances (NVAs) in one location for consistent policy enforcement across all connections.
Choosing the right connection depends on performance and cost. Cloud VPN is cost-effective for lower traffic volumes, using secure internet tunnels. For higher bandwidth and reliability, Cloud Interconnect provides a private, high-speed link, either directly (Dedicated Interconnect) or through a provider (Partner Interconnect). For connecting directly to other clouds like AWS or Azure, Cross-Cloud Interconnect establishes managed physical connections. Network Connectivity Center helps manage all these links from a central hub, while Cloud Router handles dynamic routing. Security and reliability are priorities, with options like adding IPsec encryption via HA VPN over Interconnect and SLAs up to 99.99% for highly available setups.
VPC firewall rules control traffic flow into and out of your network based on IP addresses, protocols, and ports. You can apply these rules using target tags (simple labels) or more securely with service accounts (identity-based). Hierarchical firewall policies allow you to enforce consistent security rules across all projects in an organization from a central point. In complex topologies like those using Private Service Connect, specific firewall rules manage traffic between subnets. Monitoring tools like firewall rules logging and proxy servers (like a SOCKS server) help audit access to private resources.
Google Cloud Armor protects applications from DDoS attacks and acts as a Web Application Firewall (WAF), blocking threats like SQL injection and cross-site scripting. Its Adaptive Protection uses machine learning to detect anomalous traffic and suggest custom blocking rules. Cloud IDS (Intrusion Detection System) provides deep packet inspection to find sophisticated threats like malware communication or data exfiltration inside your network. Cloud Armor Enterprise offers advanced protections, including Google Threat Intelligence to block known malicious IPs, with all events logged in Cloud Logging.
Identity-Aware Proxy (IAP) controls access to applications based on user identity, allowing secure access without public IPs or VPNs. To use IAP with a Google Kubernetes Engine (GKE) cluster, you need to enable specific services and load balancing. Setting up IAP requires a static external IP and DNS configuration to route traffic through an HTTP(S) Load Balancer. VPC Service Controls add a security layer by creating a service perimeter around resources to prevent data theft. Managing these features requires specific IAM roles, like Compute Network Admin, to control permissions.
Choosing between Global Load Balancing (using a single Anycast IP) and Regional Load Balancing determines how traffic is distributed worldwide or kept within a specific area for compliance or cost reasons. Layer 7 Proxies (like the External Application Load Balancer) inspect HTTP/HTTPS traffic for smart routing, while Layer 4 Proxies handle TCP/UDP traffic as a high-performance passthrough. Cloud Service Mesh manages internal service traffic with features like weighted traffic splitting. For containers, the GKE Gateway Controller uses the Kubernetes Gateway API for load balancing, routing traffic directly to pods via Network Endpoint Groups (NEGs) to reduce latency.
Cloud NAT allows private instances to reach the internet for updates without inbound access, and Private Google Access lets VMs with internal IPs reach Google APIs. A Shared VPC centralizes network control in a Host Project while Service Projects attach their workloads, enabling clear environment segmentation. Private Service Connect provides private access to external services or Google APIs within your VPC using endpoints, backends, and interfaces. VPC Service Controls create a security perimeter to prevent data exfiltration by blocking unauthorized interactions with managed services.
When creating a VPC Network, you choose Auto Mode for quick testing (auto-created subnets) or Custom Mode for production control over subnets and IP ranges. A Custom Mode network can be a Shared VPC. Hybrid connectivity options include Cloud Interconnect for high-speed dedicated links and Cloud VPN (especially HA VPN) for encrypted internet tunnels, both using Cloud Router for dynamic routing. Specialized setups require a Proxy-only Subnet for regional load balancers and Cloud DNS (with features like DNS Peering or Zonal DNS) for internal name resolution. A robust security posture uses Firewall Rules to block and log any unauthorized traffic at the network boundary.
When designing networks, choosing between global and regional routing determines how user requests travel across the world. Global Load Balancing utilizes a single Anycast IP to automatically se…
When designing networks, choosing between global and regional routing determines how user requests travel across the world. Global Load Balancing utilizes a single Anycast IP to automatically se…
VPC firewall rules act as virtual barriers that control the flow of data into and out of your cloud network. These rules regulate traffic based on specific criteria like IP addresses, protocols,…
VPC firewall rules act as virtual barriers that control the flow of data into and out of your cloud network. These rules regulate traffic based on specific criteria like IP addresses, protocols,…
To meet strict Service Level Agreements (SLAs) for mission-critical applications, you must design a highly available hybrid network. Google recommends a specific design using four **Cloud Intercon…
To meet strict Service Level Agreements (SLAs) for mission-critical applications, you must design a highly available hybrid network. Google recommends a specific design using four **Cloud Intercon…
To connect different Google Cloud projects or organizations, administrators use VPC Network Peering and Shared VPC. VPC Network Peering links two networks directly using internal IP addresse…
To connect different Google Cloud projects or organizations, administrators use VPC Network Peering and Shared VPC. VPC Network Peering links two networks directly using internal IP addresse…
StudyCerts
StudyCerts