Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!
Hybrid networking lets a company link its own data centers with Google Cloud so they work together as one system. Cloud VPN creates an encrypted tunnel over the public internet between the on-premises network and a GCP Virtual Private Cloud (VPC). For companies that need more reliability and speed, Cloud Interconnect provides a dedicated physical connection that bypasses the public internet entirely. Both options let on-premises servers talk to GCP resources as if they were on the same network.
Cloud Router automatically learns routes between on-premises networks and GCP VPC networks using BGP (Border Gateway Protocol). When a new subnet is added in either environment, Cloud Router shares that information without manual configuration. This means if a user in the on-premises data center needs data stored in a GCP database, the router knows exactly where to send the traffic. The router also keeps track of network changes automatically, so the connection stays working even when the network layout changes.
For critical applications that cannot afford downtime, HA VPN provides two encrypted tunnels to the on-premises network, each going through different paths. If one tunnel fails, traffic automatically switches to the backup without any manual intervention. Companies typically use HA VPN when they need 99.99% uptime, which is the industry standard for production systems. The on-premises router must support BGP and be able to handle two connections at once.
Multicloud means a company uses more than one cloud provider, such as Google Cloud alongside Amazon Web Services or Microsoft Azure. Each cloud has its own network, so traffic moving between them must cross the public internet unless a dedicated connection is set up. Cloud Interconnect can connect to other cloud providers at colocation facilities, creating a private path that keeps traffic off the public internet. This matters because public internet connections can be slower and less secure than private ones.
When a company has multiple GCP projects or VPC networks, they often need to share data between them. Shared VPC lets one central project share its network with other projects in the same organization, so all the projects can use the same subnets and routing rules. VPC Network Peering connects two separate VPC networks directly, allowing traffic to flow between them without going through the public internet. Both options keep traffic private, but Shared VPC gives the central team more control over security policies.
Cloud Firewall protects VPC networks by filtering incoming and outgoing traffic based on rules the administrator creates. There are two types: hierarchical firewall policies apply to an entire organization and all its projects, while distributed firewall rules apply to individual VPC networks. Rules can allow or block traffic based on source IP, destination IP, port, and protocol. For example, a rule might block all traffic from the internet reaching the database servers while allowing traffic from the web servers.
Cloud Armor sits in front of applications and blocks malicious traffic before it reaches the servers. It can stop DDoS attacks by absorbing massive amounts of fake requests, and it can also block SQL injection and cross-site scripting attacks that try to steal data. Cloud Armor works with Global External HTTP(S) Load Balancer to inspect every request as it enters GCP. Administrators can create security policies that match specific attack patterns, and they can also use predefined rules that Google updates as new threats appear.
Identity-Aware Proxy (IAP) adds an authentication layer in front of applications without changing the application code. When a user tries to reach an application through IAP, they must sign in with their Google account first. IAP then checks if that user has permission to access the application before letting the request through. This means even if someone knows the IP address of a private server, they cannot reach it without proper credentials.
A VPC network is the foundation that holds all GCP networking resources together. There are two modes: auto mode VPC automatically creates subnets in each region, while custom mode VPC gives the administrator full control over which subnets exist and their IP ranges. Companies usually choose custom mode when they need specific IP addresses or want to follow a detailed network plan. Each VPC network is isolated from all other VPC networks by default, meaning traffic cannot flow between them unless explicitly allowed.
Load balancers spread incoming traffic across multiple servers so no single server gets overwhelmed. Global external HTTP(S) load balancers work for applications used worldwide, routing users to the nearest server location for the fastest response. Regional load balancers work for traffic that stays within one area, such as internal applications used by a single office. The load balancer health checks each server regularly and stops sending traffic to any server that fails, which keeps the application available even when servers have problems.
Cloud NAT allows servers in a private subnet to connect to the internet for updates and downloads without exposing those servers to incoming traffic from the internet. This keeps the servers secure while still letting them reach external services they need. Private Google Access lets private instances reach Google APIs (like BigQuery or Cloud Storage) using Google's private network instead of going through the public internet. Private Service Connect provides a more modern way to access Google services and other services hosted on GCP without exposing anything to the public internet.
Prepare and test your skills
Prepare and test your skills
Cloud VPN creates an encrypted tunnel over the public internet between the on-premises network and a GCP Virtual Private Cloud (VPC). Cloud Interconnect provides a dedicated physical connection that bypasses the public internet entirely, offering more reliability and speed for companies that need it.
HA VPN should be used when you need 99.99% uptime for critical applications that cannot afford downtime. It provides two encrypted tunnels to the on-premises network, each going through different paths, so traffic automatically switches to the backup if one tunnel fails without manual intervention. The on-premises router must support BGP and be able to handle two connections at once.
Shared VPC lets one central project share its network with other projects in the same organization, so all the projects can use the same subnets and routing rules, giving the central team more control over security policies. VPC Network Peering connects two separate VPC networks directly, allowing traffic to flow between them without going through the public internet, but it does not provide the centralized control that Shared VPC offers.
Cloud Router automatically learns routes between on-premises networks and GCP VPC networks using BGP. When a new subnet is added in either environment, Cloud Router shares that information without manual configuration, keeping track of network changes automatically so the connection stays working even when the network layout changes.
StudyCerts
StudyCerts