Google Cloud Cloud Network Engineer

Connections to data centers and other clouds must survive failures. You compare connectivity options, plan redundancy and routing, and choose a design that fits bandwidth, latency and cost needs.

• Dedicated, Partner and Cross-Cloud Interconnect compared
• HA VPN and Interconnect together
• Redundancy topologies and failure behavior
• BGP route planning and advertisement
• Bandwidth and latency requirements
• Multicloud connectivity patterns

You build A hybrid connectivity design with a redundancy diagram and a routing plan.

Kubernetes clusters make big demands on IP space and routing. You plan Pod and Service ranges, choose public or private clusters, and design how traffic reaches workloads and how clusters talk to each other.

• VPC-native clusters and IP range sizing
• Private clusters and control plane access
• Exposing services with load balancers and Gateway API
• Network policies between workloads
• Multi-cluster networking patterns
• Egress from clusters

You build A GKE network design with sized ranges, private access and ingress paths.

Routing decides whether packets arrive at all. You create networks and subnets, configure static, dynamic and policy-based routes, set up peering and private access to Google APIs, and turn on flow logs.

• Creating VPCs and subnets with gcloud and Terraform
• Static and dynamic routes and routing modes
• Policy-based routes
• Configuring VPC peering and exchanging routes
• Private Google Access and Private Service Connect
• Enabling VPC Flow Logs

You build A multi-VPC network with peering, custom routes and private API access.

Hubs and spokes keep large networks manageable. You build Network Connectivity Center topologies for sites and VPCs, then configure and maintain GKE clusters, including node pools and upgrades.

• Hubs, spokes and attachments in Network Connectivity Center
• Site-to-site data transfer through Google’s network
• Creating and configuring GKE clusters
• Node pools, autoscaling and upgrades
• Cluster networking settings after creation
• Maintenance windows and change safety

You build A hub-and-spoke topology joining two VPCs and a simulated site, with a configured GKE cluster.

Load balancers are where users meet your service. You pick between external and internal, global and regional, application and network balancers, and configure backends, health checks and certificates.

• Load balancer families and how to choose
• Backend services, instance groups and network endpoint groups
• Health checks and failover
• URL maps and routing rules
• TLS certificates and termination
• Internal load balancing for private services

You build A global external load balancer with path routing and a private internal one behind it.

Speed and naming shape user experience. You cache content at the edge with Cloud CDN, control cache keys and invalidation, and design public and private DNS with forwarding and peering for hybrid names.

• Cloud CDN caching and cache keys
• Invalidation and signed requests
• Public and private managed zones
• DNS forwarding and peering zones
• DNS routing policies
• DNS security with DNSSEC

You build A cached web service with a public zone and a private zone that resolves on-premises names.

Hybrid links need careful routing to behave under failure. You provision Interconnect attachments and HA VPN tunnels, configure Cloud Router and BGP sessions, and control which paths are preferred.

• VLAN attachments for Dedicated and Partner Interconnect
• HA VPN tunnels and gateways
• Cloud Router and BGP sessions
• Route priorities, MED and path preference
• Failover between Interconnect and VPN
• Using Network Connectivity Center with hybrid links

You build A hybrid link with Interconnect primary, VPN backup and a tested BGP failover.

Connectivity faults are usually routes, rules or names. You use Google Cloud Observability, flow logs and Network Intelligence Center to prove where traffic stops and to fix it methodically.

• Metrics and logs for network health
• VPC Flow Logs analysis
• Firewall rules logging
• Connectivity Tests
• Network Intelligence Center tools
• A layered method for connectivity faults

You build A troubleshooting guide with traced and fixed examples of six connectivity problems.

Network controls limit what an attacker can reach. You write firewall policies and rules, protect web applications with Cloud Armor, and control outbound traffic with Cloud NAT and Secure Web Proxy.

• VPC firewall rules and tags
• Network firewall policies and hierarchy
• Cloud Armor policies and rate limits
• Cloud NAT configuration and logging
• Secure Web Proxy for outbound filtering
• Auditing and testing rules

You build A layered security design with firewall policies, a Cloud Armor policy and controlled egress.

Design and implement one full network. You plan addressing, connect on-premises sites, add load balancing, DNS and security, then break links and trace the effects the way an operations team would.

• Gathering requirements and constraints
• Designing topology, routing and DNS
• Implementing and securing it
• Breaking links and tracing faults
• Documenting the network and its runbooks

You build A tested hybrid network with routing plan, load balancing, DNS, security and failure results.