Design, implement, and secure Google Cloud networks, from VPCs and hybrid connectivity to load balancing and Cloud Armor, and track your readiness for the Professional Cloud Network Engineer exam.
Prepare and test your skills
Prepare and test your skills
Designing an overall network architecture means creating a complete plan for how your cloud resources will connect and communicate. This plan must support the needs of your applications, including how they scale, how they are accessed, and how they connect to other networks. A good architecture starts by defining the network's purpose, such as whether it will host a public-facing web application or a private data processing system. You then map out the necessary components like Virtual Private Cloud (VPC) networks, subnets, and connectivity to on-premises or other clouds. The final design acts as a blueprint, ensuring the network is secure, efficient, and can grow with your business.
Continue with this study guide: Designing an overall network architecture
Designing VPC networks involves creating the isolated virtual networks that will hold your Google Cloud resources. A VPC is a global resource, meaning its scope spans all Google Cloud regions, but you define subnets within specific regions to organize your resources. You must plan the IP address ranges for these subnets carefully to avoid overlaps, especially if you plan to connect multiple VPCs or to on-premises networks later. Key decisions include choosing between auto-mode VPCs, which automatically create subnets in every region, and custom-mode VPCs, which give you full control over subnet creation and IP ranges. The design also includes setting up firewall rules to control traffic and planning routes to direct traffic within and outside the VPC.
Continue with this study guide: Designing VPC networks
Designing a resilient and performant hybrid and multi-cloud network focuses on creating reliable and fast connections between Google Cloud and other environments, such as your on-premises data center or another public cloud. The primary tool for this is Cloud VPN or Cloud Interconnect, which establishes a secure, encrypted tunnel or a direct physical link. To ensure resilience, you design for high availability by setting up multiple connections through different paths or regions, so if one fails, traffic can reroute. For performance, you choose the connection type and bandwidth that matches your application's latency and throughput needs. This design ensures that your distributed applications work seamlessly as if they were all in one network.
Continue with this study guide: Designing a resilient and performant hybrid and multi-cloud network
Designing for Google Kubernetes Engine (GKE) means planning a VPC network that is optimized for running containerized applications in Kubernetes clusters. A GKE cluster is deployed into a specific subnet within your VPC. You must design this subnet with enough IP addresses for the cluster's nodes (VMs) and for the Kubernetes Pods (containers) that will run on them. Key considerations include choosing the right network model: the VPC-native model, where Pods get IPs from the VPC subnet, or the routes-based model. The design also involves configuring network policies to control traffic between Pods and planning how the cluster will access other services, like databases in the same VPC or the public internet.
Continue with this study guide: Designing for Google Kubernetes Engine (GKE)
An auto-mode VPC network automatically creates a subnet in every Google Cloud region using predefined IP ranges. In contrast, a custom-mode VPC network creates no subnets automatically, providing full control to manually define subnets and specific IP ranges region by region.
Cloud Interconnect should be used when an application requires a dedicated, physical connection delivering high bandwidth and low latency between on-premises systems and Google Cloud. Cloud VPN is suitable for lower bandwidth requirements, simpler encrypted tunnels over the public internet, or as a secondary backup connection.
You must allocate a subnet with enough IP addresses to support both the cluster nodes and the Kubernetes Pods that run on those nodes. Planning also requires selecting between a VPC-native model, where Pods receive IP addresses directly from the VPC subnet, and a routes-based model.
Last updated