Professional Cloud Security Engineer

Designing and configuring private connectivity between VPC networks and Google Cloud projects (Shared VPC, VPC peering, and Private Google Access for on-premises hosts).

This section covers connecting resources in different Google Cloud projects without using the public internet. Shared VPC allows a centralized networking model. A host project holds the VPC network and subnets, while service projects attach their resources, like VM instances, to those shared subnets. This centralizes control over firewall rules and routes. VPC peering connects two VPC networks, even across different projects or organizations, so their instances can communicate directly using internal IPs. Peering is non-transitive, meaning a peered network cannot talk to another network peered to its peer. Private Google Access for on-premises hosts extends a VPC's private connectivity to on-premises machines. When configured, hosts connected via VPN or Interconnect can reach Google APIs and services using the private IP addresses of Google's services, keeping this traffic off the public internet.

Designing and configuring private connectivity and encryption between data centers and VPC network (e.g., HA VPN, Cloud Interconnect).

This is about creating secure, reliable links from an on-premises data center to a Google Cloud VPC network. Cloud VPN establishes an encrypted tunnel over the public internet. HA VPN is the recommended high-availability version, which creates two tunnels to redundant Google Cloud VPN gateways for automatic failover if one path fails. For higher bandwidth and more consistent performance, Cloud Interconnect provides a direct physical link between the on-premises network and Google's network. Dedicated Interconnect offers a private, direct connection, while Partner Interconnect uses a service provider's network. Both VPN and Interconnect options terminate the connection into a Cloud Router within the VPC, which exchanges route information. All traffic over these links is encrypted, maintaining confidentiality across the wide-area network.

Establishing private connectivity between VPC and Google APIs (Private Google Access, Private Google Access for on-premises hosts, restricted Google access, Private Service Connect).

This focuses on allowing resources to use Google Cloud services like Cloud Storage or BigQuery without an external IP address. Private Google Access enables VMs with only internal IPs in a subnet to reach these APIs. The traffic stays within Google's network, never exposing the request to the internet. Private Google Access for on-premises hosts, as mentioned earlier, extends this private API access to connected on-premises machines. Restricted Google access is a stronger security control that forces all API traffic from a VPC to go through Private Google Access, blocking any attempt to use the public internet, even for VMs that have external IPs. Private Service Connect allows resources in a VPC to privately and securely access published services, which can be Google-managed services or your own services hosted in another VPC, using an internal IP address you choose.

Using Cloud NAT to enable outbound traffic.

Cloud NAT (Network Address Translation) lets resources in a private subnet, which have no external IP addresses, initiate outbound connections to the internet. This is useful for VMs that need to download patches or access public repositories but should not be reachable from the internet. You configure Cloud NAT on a per-subnet or per-region basis, and it uses a pool of external IP addresses you provide. When a VM in a covered subnet initiates an outbound connection, Cloud NAT translates its private source IP to one of the external IPs in the pool. Return traffic for that connection is then translated back and routed to the correct VM. Importantly, Cloud NAT only allows outbound connections initiated from within the VPC; unsolicited inbound connections from the internet are blocked, providing a secure outbound path.