Professional Cloud Network Engineer
Network Service Tiers enable organizations to configure the routing paths and performance profiles for external internet traffic reaching Google Cloud resources. The tier is selected at the resource level on virtual machine (VM) external IP addresses or load balancer forwarding rules, and Google Cloud applies Premium Tier by default. Inbound data transfer is free across both tiers, but outbound data transfer pricing per gibibyte differs based on the chosen path. Network tiers operate independently from per-VM Tier_1 networking, which is a compute configuration used to increase raw bandwidth between instances.
Premium Tier delivers external traffic across Google's private global fiber backbone network with over 100 points of presence (PoPs), providing low latency and a 99.99% availability Service Level Agreement (SLA). Inbound client traffic enters the nearest Google PoP and travels across private fiber to the destination Virtual Private Cloud (VPC), while outbound traffic follows the reverse path. In contrast, Standard Tier routes external traffic over transit internet service provider (ISP) networks, entering and exiting Google's network at the PoP closest to the destination region. Internal VPC communication, including traffic across Cloud VPN and Cloud Interconnect, always uses Premium Tier infrastructure regardless of external IP settings.
Designing for high availability and disaster recovery requires distributing workloads across failure domains and configuring dynamic routing to eliminate single points of failure. A VPC is a global resource, but subnets and dynamic routing with Cloud Router operate regionally. To protect against infrastructure outages, architectures place resources into regional Managed Instance Groups (MIGs) across multiple availability zones and replicate services across multiple regions. Outbound connectivity for private instances uses regional Cloud NAT gateways that auto-scale across multiple external IP addresses and zones to prevent port exhaustion.
Traffic steering and automatic failover depend on Cloud Load Balancing health checks and routing configurations. A global external HTTP/S load balancer routes traffic over a single Anycast IP address to the closest healthy regional backend, providing automated cross-region failover when a region fails. Regional load balancers operate within a single region, requiring Cloud DNS routing policies to steer traffic to a secondary region during an outage. Backend Managed Instance Groups use health checks for autohealing to replace failing VMs from an instance template, while horizontal autoscaling adds or removes instances based on target CPU or load balancing utilization.
High-availability hybrid connectivity achieves 99.9% availability by deploying redundant Cloud Interconnect connections across two edge availability domains in a single region. To reach a 99.99% availability SLA, organizations configure redundant connections across multiple Google Cloud regions. Traffic failover between Dedicated Interconnect, Partner Interconnect, and HA VPN tunnels relies on dynamic Border Gateway Protocol (BGP) routing policies using Multi-Exit Discriminator (MED) values and AS-Path prepending. Load balancers can also route traffic to Network Endpoint Groups (NEGs), which link container pods via zonal NEGs or on-premises systems via hybrid connectivity NEGs.
Cloud DNS provides managed name resolution across Google Cloud VPC networks, on-premises data centers, and the public internet. In hybrid architectures, bidirectional name resolution allows resources in both environments to resolve internal domain names. Outbound name resolution uses a Cloud DNS forwarding zone (Type 2 alternative name server) to send queries to on-premises DNS servers from the 35.199.192.0/19 IP address range. The on-premises network must allow ingress traffic on UDP/TCP port 53 from this range and route return traffic back through the originating Cloud VPN tunnel or Cloud Interconnect attachment.
Inbound hybrid name resolution uses a Cloud DNS inbound server policy, which creates entry-point IP addresses within VPC subnets for on-premises clients to query. For multi-VPC and Shared VPC topologies, DNS peering creates peering zones that forward queries from a consumer VPC network directly to a private zone hosted in a producer VPC network. To prevent resolution failures, organizations maintain unique, non-overlapping DNS namespaces and ensure service projects peer toward the Shared VPC host project. Additionally, DNS Response Policies intercept queries to modify DNS answers, enabling security controls like routing Google API domains to restricted endpoints for VPC Service Controls.
Cloud Load Balancing distributes incoming network traffic across backend targets to optimize performance, prevent overload, and support regional or global architectures. Global external load balancers terminate client connections at edge points of presence and route requests to the nearest healthy backend over Google's private network. Regional external load balancers restrict traffic processing to a single geographic region for compliance or network locality requirements. Internal load balancers direct private traffic between internal application tiers, using proxy-only subnets for Envoy-based proxy architectures or pass-through routing for high-throughput Layer 4 services.
Google Kubernetes Engine (GKE) network planning requires allocating sufficient IP address space for nodes, pods, and services to support cluster scaling. VPC subnets provide the primary IP address range for GKE node instances and assign secondary IP address ranges for cluster pods and service endpoints. Sizing secondary subnet ranges accurately is essential because range exhaustion prevents the cluster from provisioning new pods or scaling to handle higher workloads. Securing the GKE control plane involves configuring private clusters, establishing authorized networks, and using internal control plane endpoints to restrict management access to trusted IP ranges.
Identity and Access Management (IAM) roles establish administrative boundaries and enforce least-privilege access across network components. In a Shared VPC topology, the Shared VPC Admin role manages host project resources, while the Compute Network User role grants service project administrators permission to attach instances to specific host subnets. Dedicated administrative roles, such as DNS Admin and Compute Network Admin, restrict the ability to create load balancer forwarding rules, configure firewall rules, and modify Cloud DNS routing policies.
Connecting to Google managed services and external partner platforms requires private network integration methods that prevent exposure to the public internet. Private Services Access uses internal VPC Network Peering to connect a consumer VPC to Google-managed service producer networks over allocated internal IP ranges. Private Service Connect (PSC) allows VPC networks to reach managed services, Google APIs, and third-party producers through private endpoints or forwarding rules, eliminating IP space conflicts. Serverless VPC Access deploys connector instances within a dedicated subnet to allow serverless runtimes, such as Cloud Run and Cloud Functions, to send private traffic to internal VPC backends.
Network architecture planning requires monitoring Google Cloud resource quotas and system limits to prevent service disruptions and deployment failures. VPC networks enforce quotas on the total number of routes, firewall rules, forwarding rules, and Cloud NAT ports allocated per gateway. Exceeding these limits can block autoscaling operations, restrict routing table updates, or prevent the provisioning of new compute and hybrid connectivity resources.
StudyCerts
StudyCerts35.199.192.0/19 IP address range and require symmetric return routing across hybrid connections.Premium Tier routes external traffic across Google's private global fiber network, entering at the point of presence closest to the client and remaining on private fiber to the destination region. Standard Tier routes traffic over public internet service provider networks, only entering Google's network at the point of presence nearest to the destination region.
A Cloud DNS forwarding zone directs queries for a specific external or on-premises domain to designated name servers outside of Cloud DNS. A DNS peering zone forwards queries from a consumer VPC network to a private Cloud DNS zone hosted inside another VPC network within Google Cloud.
Autohealing uses application health check failures to trigger the recreation of unhealthy individual virtual machines from an instance template. Autoscaling dynamically increases or decreases the total count of running virtual machines in response to workload metrics such as CPU or load balancer utilization.
Prepare and test your skills
Prepare and test your skills