Professional Cloud Network Engineer — Architectural Takeaways

Book TOC · Chapter 0 of 8 · Next: Chapter 1

Chapter 0: The PCNE Reference Stack & 10 Core Principles

Chapter Focus: A visual guide to the Google Cloud Certified Professional Cloud Network Engineer (PCNE) architecture stack, how the core Google Cloud services fit together, and the 10 Core Architectural Principles that govern production design decisions.

1. The Master Architectural Map: The Google Cloud Networking Stack

The official Google Cloud Professional Cloud Network Engineer Curriculum spans 6 Sections and 22 Subsections. Rather than memorizing services in isolation, organize the entire Google Cloud networking portfolio across Six Architectural Planes:

1. Core VPC, IPAM & Multi-Network Fabric (Sections 1.1, 1.2, 2.1, 2.2, 2.3) VPC Networks (Global) • Custom Subnets (Regional) • Shared VPC (Host/Service) • MTU 1460 to 8896 Jumbo IPAM & Private Addressing • RFC 1918 & Non-RFC 1918 •PUPI & BYOIP (PAP/PDP) • Dual-Stack IPv6 (/64) • Internal Ranges Inter-VPC Fabric & Routing • VPC Network Peering • Network Connectivity Center (NCC) • Static, Dynamic & Policy-Based Routes • Private NAT 2. Private Service & API Connectivity Plane (Sections 1.1g, 1.3f-g, 2.1e) Private Google Access (PGA) • 199.36.153.8/30 (private.googleapis.com) • 199.36.153.4/30 (restricted.googleapis.com) Private Service Connect (PSC) • PSC Endpoints (Forwarding Rule) • PSC Backends (NEG + L7 LB) • PSC Service Attachments (Producer ILB) Private Services Access (PSA) & Serverless VPC Access / Direct VPC Egress 3. Container & GKE Networking Plane (Sections 1.4, 2.4) VPC-Native GKE Clusters • Alias IPs (Node, Pod, Service CIDRs) • Multi-Pod CIDR Discontiguous Ranges • GKE Dataplane V2 (Cilium eBPF) GKE Control Plane & Isolation • Private Nodes & Private Endpoint • DNS-Based Control Plane Endpoint • Authorized Networks & IP Masquerade • NodeLocal DNSCache & Cloud DNS for GKE 4. Managed Application Delivery, CDN & DNS Plane (Section 3) Cloud Load Balancing • Global & Regional Application LB (L7 Envoy/GFE) • Proxy Network LB (TCP/SSL) • Passthrough Network LB (L4 Maglev/Andromeda) • Zonal, Serverless, Internet & Hybrid NEGs Cloud CDN • Cache Modes & Cache Keys • Signed URLs & Signed Cookies • Origin Auth (AWS SigV4 / Custom Origins) Cloud DNS • Public, Private & Split-Horizon Zones • Inbound Server Policies & Outbound Forwarding • DNS Peering & Cross-Project Binding • WRR, Geolocation, Failover & DNSSEC 5. Hybrid & Multicloud Interconnectivity Plane (Sections 1.3, 4) Cloud Interconnect • Dedicated Interconnect (10G/100G + MACsec) • Partner Interconnect (50M-50G, L2/L3) • Cross-Cloud Interconnect (AWS/Azure/OCI) • 99.9% vs 99.99% SLA Topologies Cloud VPN • HA VPN (99.99% SLA, Dual-Interface BGP) • HA VPN over Cloud Interconnect • Classic VPN (Deprecated Policy/Route) Cloud Router & NCC Hybrid • BGP (ASN, MED, AS-Path, Custom Routes) • BFD Sub-Second Failure Detection • Legacy vs Standard Best Path Selection • NCC Hybrid Spokes, Site-to-Site & Router Appliances 6. Network Security & Observability Plane (Sections 5, 6) Perimeter, Firewall & Egress Security • Cloud Armor (WAF, Adaptive Protection, Bot/Rate) • Cloud NGFW (Essentials, Standard, Enterprise IPS) • Hierarchical Policies & IAM Secure Tags • Public Cloud NAT & Secure Web Proxy (SWP) • Multi-NIC NVAs, VPC-SC & Packet Mirroring Observability & Network Intelligence Center • Connectivity Tests, Network Topology • Performance Dashboard, Firewall Insights • Network Analyzer, Flow Analyzer • VPC Flow Logs, Firewall Logs & Cloud Monitoring

Complete Reference Table of In-Scope Google Cloud Networking Services

#
Service / Capability
Architectural Plane
Primary Architectural Responsibility
1
Virtual Private Cloud (VPC) & Subnets
Core VPC Fabric
Global software-defined virtual network (Andromeda) with regional subnets, secondary alias IP ranges, dynamic subnet expansion, Dual-Stack IPv6 (/64), and configurable MTU (1460 default up to 8896 jumbo frames).
2
Network Service Tiers (Premium vs. Standard)
Core VPC Fabric
Premium Tier routes traffic over Google's private global fiber backbone (cold-potato routing) with global Anycast IPs; Standard Tier routes over the public ISP internet (hot-potato routing) with regional IPs.
3
Shared VPC
Core VPC Fabric
Centralizes network administration in a Host Project while delegating compute workloads (VMs, GKE, LBs) to Service Projects via least-privilege subnet-level compute.networkUser IAM bindings.
4
VPC Network Peering
Inter-VPC Fabric
Direct, non-transitive Layer 3 peering between two VPCs (up to 25 peerings per VPC) supporting optional custom route import/export (--export-custom-routes / --import-custom-routes) with zero IP overlap allowed.
5
Network Connectivity Center (NCC)
Inter-VPC & Hybrid Fabric
Hub-and-spoke transit control plane supporting VPC Spokes (full-mesh or star topology with core/edge groups), Producer Spokes, Hybrid Spokes (VPN, VLAN attachments, Router Appliances), Site-to-Site Data Transfer, and CIDR filters.
6
IP Address Management (IPAM) & BYOIP / PUPI
Core VPC Fabric
Managing RFC 1918, non-RFC 1918 (100.64.0.0/10), Privately Used Public IPs (PUPI), Bring Your Own IP (BYOIP) via Public Advertised Prefixes (PAP) and Public Delegated Prefixes (PDP), and InternalRange reservations.
7
PrivateNAT & Public Cloud NAT
NAT & Egress Plane
Software-defined source NAT without choke-point VMs: Public Cloud NAT provides outbound internet access for private VMs/Pods; Private NAT translates overlapping RFC 1918 CIDRs across NCC spokes or hybrid links.
8
VPC Routing & Policy-Based Routing (PBR)
Core VPC Fabric
Evaluating local subnet routes, custom static routes (tagged or untagged), dynamic BGP routes (Regional vs. Global mode), Internal Passthrough LB as Next Hop, and highest-precedence Policy-Based Routes matching source IP/protocol/L4 ports.
9
Private Google Access (PGA)
Private API Plane
Allows VMs without external IPs to reach Google APIs over private.googleapis.com (199.36.153.8/30) or VPC-SC compliant restricted.googleapis.com (199.36.153.4/30).
10
Private Service Connect (PSC)
Private Service Plane
Unidirectional, NAT-based private service consumption and publishing via PSC Endpoints (consumer IP), PSC Backends (NEG + L7 LB), PSC Interfaces, and Service Attachments—immune to overlapping CIDRs and non-transitive peering limits.
11
Private Services Access (PSA) & Serverless VPC Access
Private Service Plane
PSA connects consumer VPCs to Google-managed producer VPCs (Cloud SQL, Memorystore, Filestore) via VPC Peering; Direct VPC Egress and Serverless VPC Access Connectors link Cloud Run/Functions to VPC internal IPs.
12
VPC Service Controls (VPC-SC)
Security Perimeter
Identity- and context-aware service perimeter around Google-managed multi-tenant APIs (Cloud Storage, BigQuery, Vertex AI, GKE) preventing data exfiltration via stolen credentials or unauthorized projects.
13
GKE VPC-Native Networking & Dataplane V2
Container Plane
Alias IP secondary ranges for Pods/Services, discontiguous multi-Pod CIDR expansion, private nodes & private/DNS-based control plane endpoints, IP Masquerade (ip-masq-agent), and Cilium/eBPF-powered Dataplane V2 with native NetworkPolicy enforcement.
14
Application Load Balancers (L7 HTTP/HTTPS)
Managed Delivery
Proxy-based Layer 7 load balancers (Global External, Classic, Regional External, Cross-Region Internal, Regional Internal) providing URL maps, host/path routing, traffic splitting, mirroring, and TLS offloading.
15
Proxy & Passthrough Network Load Balancers (L4)
Managed Delivery
Proxy Network LBs terminate TCP/SSL connections at Envoy/GFE proxies; Passthrough Network LBs (External & Internal) use Maglev/Andromeda direct server return (DSR) to preserve original client source IPs and support all IP protocols (TCP, UDP, ESP, ICMP).
16
Network Endpoint Groups (NEGs)
Managed Delivery
Modular backend abstractions: Zonal NEGs (GCE_VM_IP_PORT for container-native GKE Pod routing), Serverless NEGs, Internet NEGs (INTERNET_FQDN_PORT / INTERNET_IP_PORT), Hybrid NEGs (NON_GCP_PRIVATE_IP_PORT), and PSC NEGs.
17
Cloud CDN
Managed Delivery
Global edge caching for HTTP(S) Load Balancers supporting CACHE_ALL_STATIC, USE_ORIGIN_HEADERS, FORCE_CACHE_ALL, custom cache keys, rapid cache invalidation, Signed URLs / Signed Cookies, and third-party S3 origin auth.
18
Cloud DNS
Managed Delivery
Authoritative and recursive DNS supporting Public Zones (with DNSSEC, WRR/Geo/Failover routing), Private Zones (Split-Horizon, Cross-Project Binding), DNS Peering, Outbound Forwarding Zones, Inbound Server Policies (35.199.192.0/19), and Cloud DNS for GKE.
19
Cloud Interconnect (Dedicated, Partner, Cross-Cloud)
Hybrid & Multicloud
High-speed physical connectivity: Dedicated (10G/100G direct colocation with optional L2 MACsec), Partner (50M–50G via L2/L3 carrier), and Cross-Cloud (direct link to AWS, Azure, OCI), engineered for 99.9% (1 metro, 2 EADs) or 99.99% (2 metros, 4 EADs) SLAs.
20
Cloud VPN (HA VPN & Classic VPN)
Hybrid & Multicloud
HA VPN delivers a 99.99% SLA using two external IP interfaces (if0/if1), mandatory Cloud Router BGP, and optional deployment over Cloud Interconnect for IPsec encryption; Classic VPN is legacy single-interface VPN (99.9% SLA).
21
Cloud Router (BGP & BFD)
Hybrid & Multicloud
Control-plane-only dynamic routing speaker exchanging prefixes via eBGP (169.254.x.x/30 link-local IPs), supporting custom route advertisements, custom learned routes, MED / AS-Path prepending, BFD sub-second failure detection, and Standard vs. Legacy best path selection.
22
Google Cloud Armor
Network Security
Edge and backend DDoS mitigation and WAF engine featuring preconfigured OWASP CRS rules (sqli, xss, rce, lfi), Adaptive Protection (ML L7 anomaly detection), rate-based bans, reCAPTCHA Enterprise bot management, and Google Threat Intelligence feeds.
23
Cloud Next Generation Firewall (NGFW) & Hierarchical Policies
Network Security
Three tiers—Essentials (L4 policies, IAM Secure Tags, address groups), Standard (FQDN, Geolocation, Threat Intelligence), and Enterprise (inline L7 IPS with Palo Alto Networks threat signatures via zonal Firewall Endpoints)—plus goto_next delegation.
24
Secure Web Proxy (SWP)
Network Security
Managed regional outbound HTTP/HTTPS proxy inspecting egress traffic from VMs/GKE by URL list, FQDN, Secure Tag, or Service Account with optional TLS decryption—requiring zero client agent software.
25
Multi-NIC Network Virtual Appliances (NVAs) & Packet Mirroring
Network Security
Inline inspection using multi-NIC VMs (--can-ip-forward) behind symmetric Internal Passthrough LBs as Next Hops with Policy-Based Routes, or out-of-band full-packet capture using Packet Mirroring to an --is-mirroring-collector ILB.
26
Network Intelligence Center & Google Cloud Observability
Observability Plane
Six diagnostic tools—Network Topology, Connectivity Tests, Performance Dashboard, Firewall Insights, Network Analyzer, and Flow Analyzer—paired with VPC Flow Logs, Firewall Rules Logging, and Cloud Monitoring metrics.

2. The 10 Core Architectural Principles of the Architecture Stack

Before you tackle your first challenge in Chapter 1, internalize these 10 Core Architectural Principles. Whenever you are torn between two plausible-sounding options In production architectures, these laws will break the tie:

  1. Principle 1 — VPC Network Peering Is Strictly Non-Transitive and Intolerant of IP Overlap: If VPC-A peers with VPC-B, and VPC-B peers with VPC-C, VPC-A cannot reach VPC-C over peering—and any overlapping subnet CIDR across the peered networks blocks peering creation or expansion. When you see overlapping IP ranges, producer-consumer isolation, or more than 25 peered VPCs, immediately pivot to Private Service Connect (PSC), Network Connectivity Center (NCC) with Private NAT, or Multi-NIC NVAs.
  2. Principle 2 — Know the 3 Private Google Connectivity Patterns Cold (PGA vs. PSA vs. PSC):
  3. Need private VMs to call multi-tenant Google APIs (storage.googleapis.com, bigquery.googleapis.com, aiplatform.googleapis.com)? Enable Private Google Access (PGA) and route DNS CNAMEs to private.googleapis.com (199.36.153.8/30) or restricted.googleapis.com (199.36.153.4/30 when using VPC Service Controls) — or create a single consumer-side Private Service Connect (PSC) endpoint for Google APIs (e.g., 10.0.0.5 or 198.18.0.1).
  4. Need to connect a VPC to a Google-managed tenant VPC like Cloud SQL, Memorystore, or Filestore using an allocated /16 or /20 IP range? That is Private Services Access (PSA), which uses underlying VPC Network Peering.
  5. Need to publish or consume a service across organizations/VPCs via a single internal IP (ForwardingRule → ServiceAttachment → Producer Internal LB) with zero CIDR coordination? That is Private Service Connect (PSC).
  6. Principle 3 — Cloud Router Is Strictly Control Plane; Never Put It in the Data Plane Path: Cloud Router speaks BGP over link-local 169.254.0.0/16 addresses to program the VPC's software-defined Andromeda routing table. Packets never pass through a Cloud Router VM. And if an on-premises network connected in us-central1 cannot reach a VPC subnet in europe-west1 (or cannot transit through a VPC to another spoke), check whether the VPC's Dynamic Routing Mode is set to REGIONAL instead of GLOBAL.
  7. Principle 4 — Memorize the Exact SLA Topologies (99.9% vs. 99.99%) for HA VPN and Cloud Interconnect:
  8. HA VPN 99.99% SLA: Requires 1 HA VPN Gateway (which automatically has 2 interfaces if0 and if1) with 2 tunnels (one from if0, one from if1) connected to 2 distinct external peer interface IPs (either 2 separate on-premises devices or 1 redundant dual-IP device), backed by Cloud Router and GLOBAL dynamic routing.
  9. Cloud Interconnect 99.9% SLA (Non-Critical): Requires 2 Interconnect connections (or 2 Partner VLAN attachments) in 1 Metropolitan Area (Metro) across 2 distinct Edge Availability Domains (EADs / Zones).
  10. Cloud Interconnect 99.99% SLA (Mission-Critical): Requires 4 Interconnect connections (or 4 Partner VLAN attachments) split across 2 distinct Metropolitan Areas (Metros) and 2 distinct EADs per metro, connected to Cloud Routers in 2 GCP regions with GLOBAL dynamic routing.
  11. Principle 5 — Match the Load Balancer to Proxy vs. Passthrough and Client IP Preservation:
  12. Need URL maps, Cloud CDN, Cloud Armor WAF, header/path routing, or TLS offloading? Choose an Application Load Balancer (ALB). Client IP is passed in the X-Forwarded-For header (and any regional Envoy-based LB requires a regional REGIONAL_MANAGED_PROXY proxy-only subnet).
  13. Need to preserve the original client source IP packet header natively without PROXY protocol headers, or load-balance UDP / ESP / ICMP / all-ports, or serve as a Next Hop route / Packet Mirroring collector? Choose a Passthrough Network Load Balancer (Internal or External).
  14. Principle 6 — In GKE, Always Use VPC-Native (Alias IPs), Container-Native LB (GCE_VM_IP_PORT NEGs), and Dataplane V2:
  15. VPC-Native Clusters assign Pod IPs from a subnet secondary CIDR range, making Pods natively routable across VPC Peering, HA VPN, and Cloud Interconnect without custom static route quotas. Remember that GKE reserves 2x the --max-pods-per-node value for each node's Pod CIDR slice (e.g., 110 max Pods → requires 220 IPs → rounds up to a /24 (256 IPs) per node; 32 max Pods → 64 IPs → /26 per node).
  16. When a GKE Pod subnet runs out of IPs, you cannot expand a secondary CIDR range in place; instead, use Discontiguous Multi-Pod CIDR to add a new secondary range and bind it to a new Node Pool (--pod-ipv4-range).
  17. Container-Native Load Balancing (GCE_VM_IP_PORT Zonal NEGs) allows Google Cloud L7 Load Balancers and health checks to route directly to Pod IPs, bypassing kube-proxy NodePort double-hops.
  18. Principle 7 — Hybrid DNS Requires Two Distinct Constructs (Outbound Forwarding Zones vs. Inbound Server Policies):
  19. GCP → On-Premises Resolution: Create a Cloud DNS Private Forwarding Zone for the on-premises domain (e.g., corp.internal.) pointing to on-premises DNS server IPs (returns comes from 35.199.192.0/19).
  20. On-Premises → GCP Resolution: Enable a Cloud DNS Inbound Server Policy on the VPC, which allocates a regional internal IP from each subnet so on-premises DNS forwarders can query Cloud DNS private zones and private.googleapis.com over VPN/Interconnect.
  21. Principle 8 — Policy-Based Routing (PBR) Beats All Standard Routes; Longest Prefix Match Beats Priority:
  22. In standard destination-based routing, Google Cloud always selects the most specific prefix (Longest Prefix Match) first (e.g., a /24 route with priority 5000 always beats a /16 route with priority 100!). Route priority (0 to 65535, lower number wins) and BGP MED only break ties between routes with the exact same destination prefix length.
  23. When you must route based on source IP, protocol, or override a local subnet route to force east-west traffic through a Next-Hop NVA Internal Load Balancer, use Policy-Based Routing (PBR)—and always exclude the NVA's own traffic (via network tags or source filters) so you don't create a routing loop!
  24. Principle 9 — Use IAM-Governed Secure Tags Over Legacy Network Tags, and Know Hierarchical goto_next:
  25. Legacy Network Tags can be modified by any user with compute.instances.setTags (VM Admin) and do not work across VPC Network Peering. Resource Manager Secure Tags are cryptographically bound to IAM permissions, work across Hierarchical, Global, and Regional NGFW Policies, and support cross-VPC peering segmentation.
  26. In a Hierarchical Firewall Policy (Organization → Folder → VPC), an explicit allow or deny terminates evaluation immediately; you must use goto_next when a parent policy wants to delegate evaluation of unmatched or specific traffic down to lower-level policies.
  27. Principle 10 — Match the Diagnostic Tool to the Layer (VPC Flow Logs vs. Firewall Logs vs. Packet Mirroring vs. Connectivity Tests):
  28. VPC Flow Logs are captured at the VM's vNIC after ingress firewall ALLOW rules and before egress firewall DENY rules. Therefore, packets dropped by an ingress firewall rule NEVER appear in VPC Flow Logs—you must enable Firewall Rules Logging to see blocked connections!
  29. VPC Flow Logs only record 5-tuple metadata headers and byte/packet counters. If compliance or an IDS requires full Layer 7 packet payload inspection, you must configure Packet Mirroring (or inline Cloud NGFW Enterprise).
  30. To verify whether a complex chain of routes, BGP advertisements, VPC-SC, and firewall policies will allow traffic without sending live production packets, run a Network Intelligence Center Connectivity Test.

Book TOC · Chapter 0 of 8 · Next: Chapter 1

AwesomeGCP.com Learning

The approach taken is a question-led learning approach: you explore realistic project scenarios where you need to make decisions or take actions to achieve business goals within specific constraints. Instead of passive learning, you are challenged to think and work through the options to master the Professional Cloud Network Engineer (PCNE) certification!

Practice PCNE Questions