Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!
Google Cloud offers different ways to distribute incoming traffic depending on the scale of your application. Global load balancing uses a single Anycast IP address to route users to the nearest healthy backend anywhere in the world. In contrast, regional load balancing keeps traffic within a specific geographic area to satisfy data residency laws or lower network costs. Selecting the right scope helps keep applications highly available even during large-scale regional outages.
To achieve this, you can choose from several specific load balancing options:
When choosing a traffic management strategy, you must evaluate the layer at which your traffic operates. Layer 7 proxies, such as the application load balancer, work at the application level to manage HTTP and HTTPS traffic. These proxies support advanced traffic steering features like URL maps for routing requests based on path names and TLS termination to handle encryption keys securely. On the other hand, Layer 4 proxies handle TCP and UDP traffic at the transport level without inspecting the application data inside. You should choose Layer 7 proxies for complex web applications and Layer 4 proxies for high-performance, non-HTTP services.
For complex microservice architectures, Cloud Service Mesh manages internal service-to-service communication. This tool configures sidecar proxies to perform advanced routing tasks like weight-based traffic splitting and request mirroring for testing new software versions. Setting up a second-level gateway at the edge of your service mesh creates a clean boundary between different teams. Using this setup also grants access to advanced header-based routing, native integration with Cloud Armor for security, and custom logic through Service Extensions.
Private Service Connect allows systems to safely access services across different VPC networks without configuring complex network peering. This model uses Endpoints and Backends to securely map service traffic to internal IP addresses. For hybrid networks, tools like Cloud Interconnect and Cloud VPN bridge the gap between on-premises data centers and your cloud resources. A well-designed network architecture ensures that traffic heading to cloud-adjacent services remains both private and highly performant.
The GKE Gateway Controller manages traffic for containerized applications running on Google Kubernetes Engine by utilizing the Kubernetes Gateway API. It supports multi-cluster load balancing, which automatically redirects traffic to a different region if a cluster fails. This system relies on container-native load balancing, which uses Network Endpoint Groups (NEGs) to route traffic directly to individual pod IP addresses. By bypassing the virtual machine layer, this direct routing decreases network latency and improves the accuracy of backend health checks.
Cloud NAT is a fully managed service that allows Google Cloud resources to access the internet without needing public IP addresses. This secure egress tool ensures that your virtual machines stay private while still allowing them to download updates or reach external APIs. To reach Google's own services, you can enable Private Google Access, which allows virtual machines with only internal IP addresses to reach Google APIs and services. Together, these tools prevent outside threats from starting direct, unsolicited connections to your private virtual machines.
A Shared VPC allows an organization to connect resources from multiple distinct projects to a single, common network. In this design, a host project controls the subnets, routes, and firewalls, while service projects host the actual application workloads. Separating environments like production and testing into different Shared VPCs provides strong network isolation and simplifies security policies. This setup ensures that development teams can manage their applications independently while the central networking team retains control over the core network.
Private Service Connect allows you to consume Google APIs or third-party services privately within your virtual network. It removes the need for complex VPC peering, establishing clear boundaries between service producers and consumers. You can configure this technology using three primary connection types:
To connect on-premises data centers with Google Cloud, organizations deploy Cloud Interconnect and Cloud VPN for hybrid connectivity. These systems rely on Cloud Router to manage dynamic routing, which automatically updates network paths using the Border Gateway Protocol. Secure ingress traffic entering the cloud is managed by external and internal load balancers, which block malicious requests when integrated with Cloud Armor. These tools work in tandem to guarantee that all traffic entering or leaving your cloud network is safe and efficient.
VPC Service Controls create a service perimeter that protects sensitive data by restricting access to Google-managed services. This security layer is specifically designed to stop data exfiltration, which is the unauthorized transfer of data out of your secure environment. By defining these perimeters, you ensure that only authorized projects and networks can interact with your critical data resources. This protection operates independently of standard identity and access management rules, providing defense in depth.
A VPC Network is a virtual version of a physical network that provides connectivity for your virtual machines and other resources. When creating a network, you can choose Auto Mode, which automatically creates subnets in every Google Cloud region, or Custom Mode, which requires you to manually define IP ranges. Custom Mode is the preferred choice for production environments because it prevents IP address conflicts and allows for a more secure, tailored design.
A Shared VPC allows an organization to centralize its network administration by linking multiple projects to a single, common network. The host project acts as the owner of the network infrastructure, including all subnets and routing configurations, while service projects use these resources to run applications. This separation of ownership allows central network teams to enforce security standards while giving application teams the freedom to deploy workloads.
To bridge on-premises data centers with Google Cloud, you can choose between Cloud Interconnect and Cloud VPN. Cloud Interconnect provides a direct, high-speed physical link, whereas Cloud VPN establishes encrypted tunnels over the public internet. If you choose VPN, deploying HA VPN guarantees high availability and supports dual-stack configurations for managing both IPv4 and IPv6 traffic.
Google Cloud load balancing distributes incoming traffic across multiple instances to keep applications scalable and reliable. When deploying certain regional Envoy-based load balancers, you must configure a Proxy-only Subnet within your VPC. This specialized subnet allocates IP addresses that the load balancer uses to perform source NAT and deliver traffic to your backends. These subnets are required for regional advanced traffic management and cannot be used for hosting standard virtual machines.
Cloud DNS translates human-readable resource names into IP addresses within your virtual environment. To allow resources in separate VPC networks to find each other, you can use DNS Peering or cross-project binding to share zone records. For even greater reliability, you can configure Zonal Cloud DNS, which limits DNS data and failure domains to a single Google Cloud zone.
To keep sensitive data safe, VPC Service Controls establish a service perimeter that blocks unauthorized communication with Google-managed services. Inside the VPC, enabling Private Google Access allows private virtual machines to reach Google APIs without exposing them to the internet. Finally, implementing a "final drop" strategy with Firewall Rules ensures that all unwanted traffic is explicitly blocked and logged for security auditing.
Prepare and test your skills
Prepare and test your skills
Global load balancing uses a single Anycast IP address to route users to the nearest healthy backend anywhere in the world. Regional load balancing keeps traffic within a specific geographic area to satisfy data residency laws or lower network costs.
Layer 7 proxies work at the application level to manage HTTP and HTTPS traffic and support advanced traffic steering features like URL maps for routing based on path names and TLS termination. Layer 4 proxies handle TCP and UDP traffic at the transport level without inspecting application data. Choose Layer 7 for complex web applications and Layer 4 for high-performance, non-HTTP services.
Auto Mode automatically creates subnets in every Google Cloud region, while Custom Mode requires you to manually define IP ranges. Custom Mode is preferred for production environments because it prevents IP address conflicts and allows for a more secure, tailored design.
Private Service Connect allows systems to safely access services across different VPC networks without configuring complex network peering. It uses three primary connection types: Endpoints (which use forwarding rules to provide a private IP address for a service), Backends (which use load balancers to direct traffic to external services), and Interfaces (which enable direct, two-way communication between consumers and producers).
Attach the partner's project as a Shared VPC service project to the central host project, and provision the service on a dedicated subnet.
Establish VPC Network Peering between the central VPC and the partner VPC, and configure custom route exchange with transitive routing enabled.
Deploy an HA VPN gateway tunnel between the central VPC and the partner VPC, and configure BGP route advertisements for the analytics service subnet.
Publish the analytics service using a Private Service Connect service attachment, and create a Private Service Connect endpoint with global access enabled in the central VPC.
An enterprise has established hybrid connectivity between its on-premises data center and a central Google Cloud Virtual Private Cloud (VPC) network using Dedicated Interconnect.
A partner team hosts a proprietary analytics service behind an internal Network Load Balancer in a separate, isolated VPC project. You need to enable private access to this analytics service from both on-premises systems and cloud instances located across multiple Google Cloud regions.
Your solution must meet the following requirements:
Which network architecture should you implement?
StudyCerts
StudyCerts