1. Exam Overview
1.1. Exam Subject Areas
1.2. Exam Format
1.3. Supplemental Study Materials
1.4. Sign up for a Free Tier
1.5. Register for the Exam
1.5.1. Schedule the Exam
1.5.2. Rescheduling and Cancellation Policy
1.5.3. Exam Results
1.5.4. Retake Policy
1.6. Summary
2. Designing, planning, and prototyping a Google Cloud network
2.1. Designing an overall network architecture
2.1.1. High availability, failover, and disaster recovery strategies
2.1.2. DNS strategy (e.g., on-premises, Cloud DNS)
2.1.3. Security and data exfiltration requirements
2.1.4. Load balancing
2.1.5. Applying quotas per project and per VPC
2.1.6. Hybrid connectivity (e.g., Google private access for hybrid connectivity)
2.1.7. Container networking
2.1.8. SaaS, PaaS, and IaaS services
2.2. Designing Virtual Private Cloud (VPC) instances
2.2.1. VPC Specifications
2.2.2. Subnets
2.2.3. IP address management and brin your own IP (BYOIP)
2.2.4. Standalone vs. Shared VPC
2.2.5. Multiple vs. single
2.2.6. Regional vs. multi-regional
2.2.7. VPC Network Peering
2.2.8. Firewalls (e.g., service account-based, tag-based)
2.2.9. Custom routes
2.3. Designing a hybrid and multi-cloud network
2.3.1. Drivers for Hybrid and Multi-cloud strategy
2.3.2. Overall goals
2.3.3. Designing a Hybrid and Multi-cloud strategy
2.3.4. Dedicated Interconnect vs. Partner Interconnect
2.3.5. Direct vs. Carrier Peering
2.3.6. IPsec VPN
2.3.7. Bandwidth and constraints provided by hybrid connectivity solutions
2.3.8. Cloud Router
2.3.9. Multi-cloud and Hybrid topologies
2.3.10. Regional vs. global VPC routing mode
2.3.11. Failover and Disaster Recovery strategy
2.3.12. Accessing Google Services/APIs privately from on-premises locations
2.3.13. IP address management across on-premises locations and cloud
2.4. Designing an IP addressing plan for Google Kubernetes Engine
2.4.1. GKE VPC-native clusters
2.4.2. Optimizing GKE IP ranges
2.4.3. Expanding GKE IP ranges
2.4.4. Public and private cluster nodes
2.4.5. Control plane public vs. private endpoints
2.5. Summary
2.6. Exam questions
3. Implementing Virtual Private Cloud (VPC) instances
3.1. Configuring VPC resources
3.1.1. Creating VPCs
3.1.2. Creating subnets
3.1.3. Listing subnets
3.1.4. Listing VPCs
3.1.5. Deleting VPCs
3.2. Configuring VPC Network Peering
3.3. Creating a Shared VPC network and sharing subnets with other projects
3.3.1. Host and service project concepts
3.3.2. Shared VPC deep dive
3.3.3. Assigning roles to principals
3.3.4. Creating the shared VPC
3.3.5. Creating the service projects
3.3.6. Enabling Compute API for service and host projects
3.3.7. Enabling host project
3.3.8. Attaching service projects
3.3.9. Assigning individual subnet-level roles to service projects
3.4. Using a Shared VPC
3.4.1. Listing usable subnets
3.4.2. Creating VMs
3.4.3. Verifying VMs connectivity
3.4.4. Deleting VMs
3.5. Sharing subnets using folders
3.6. Configuring API access to Google services (e.g., Private Google Access, public interfaces)
3.6.1. Configuring Private Google Access (PGA)
3.6.2. Configuring Private Service Connect (PSC)
3.7. Expanding VPC subnet ranges after creation
3.8. Configuring routing
3.8.1. Static vs. dynamic routing
3.8.2. Global vs. regional dynamic routing
3.8.3. Routing policies using tags and priority
3.8.4. Internal load balancer as a next hop
3.8.5. Custom route import/export over VPC Network Peering
3.9. Configuring and maintaining Google Kubernetes Engine clusters. Considerations include:
3.9.1. VPC-native clusters using alias IPs
3.9.2. Clusters with Shared VPC
3.9.3. Creating Cluster Network Policies
3.9.4. Private clusters and private control plane endpoints
3.9.5. Adding authorized networks for cluster control plane endpoints
3.10. Configuring and managing firewall rules. Considerations include:
3.10.1. Target network tags and service accounts
3.10.2. Rule priority
3.10.3. Protocols and Ports
3.10.4. Direction
3.10.5. Firewall rule logs
3.10.6. Summary
4. Implementing VPC Service Controls
4.1. Creating and configuring access levels and service perimeters
4.2. Service perimeter deep dive
4.3. VPC accessible services
4.4. Perimeter bridges
4.5. Audit logging
4.6. Dry run mode
4.7. Dry-run perimeter deep dive
4.8. Exam questions
5. Configuring load balancing
5.1. Google Cloud load balancers family
5.2. Backend services and network endpoint groups (NEGs)
5.3. Firewall rules to allow traffic and health checks to backend services
5.4. Health checks for backend services and target instance groups
5.5. Configuring backends and backend services with balancing method (e.g., RPS, CPU, Custom), session affinity, and capacity scaling/scaler
5.6. TCP and SSL proxy load balancers
5.7. Load balancers (e.g., External TCP/UDP Network Load Balancing, Internal TCP/UDP Load Balancing, External HTTP(S) Load Balancing, Internal HTTP(S) Load Balancing)
5.8. Protocol forwarding
5.9. Accommodating workload increases using autoscaling vs. manual scaling
5.10. Configuring Google Cloud Armor policies. Considerations include:
5.11. Security policies
5.12. Web application firewall (WAF) rules (e.g., SQL injection, cross-site scripting, remote file inclusion)
5.13. Attaching security policies to load balancer backends
5.14. Configuring Cloud CDN. Considerations include:
5.15. Enabling and disabling
5.16. Cloud CDN
5.17. Cache keys
5.18. Invalidating cached objects
5.19. Signed URLs
5.20. Custom origins
6. Configuring advanced networking services
6.1. Configuring and maintaining Cloud DNS
6.1.1. Managing zones and records
6.1.2. Migrating to Cloud DNS
6.1.3. DNS Security Extensions (DNSSEC)
6.1.4. Forwarding and DNS server policies
6.1.5. Integrating on-premises DNS with Google Cloud
6.1.6. Split-horizon DNS
6.1.7. DNS peering
6.1.8. Private DNS logging
6.2. Configuring Cloud NAT
6.2.1. Addressing
6.2.2. Port allocations
6.2.3. Customizing timeouts
6.2.4. Logging and monitoring
6.2.5. Restrictions per organization policy constraints
6.3. Configuring network packet inspection
6.3.1. Packet Mirroring in single and multi-VPC topologies
6.3.2. Capturing relevant traffic using Packet Mirroring source and traffic filters
6.3.3. Routing and inspecting inter-VPC traffic using multi-NIC VMs (e.g., next-generation firewall appliances)
6.3.4. Configuring an internal load balancer as a next hop for highly available multi-NIC VM routing
7. Implementing hybrid interconnectivity
7.1. Configuring Cloud Interconnect
7.1.1. Dedicated Interconnect connections and VLAN attachments
7.1.2. Partner Interconnect connections and VLAN attachments
7.2. Configuring a site-to-site IPsec VPN
7.2.1. High availability VPN (dynamic routing)
7.2.2. Classic VPN (e.g., route-based routing, policy-based routing)
7.3. Configuring Cloud Router
7.3.1. Border Gateway Protocol (BGP) attributes (e.g., ASN, route priority/MED, link-local addresses)
7.3.2. Custom route advertisements via BGP
7.3.3. Deploying reliable and redundant Cloud Routers
8. Managing network operations
8.1. Logging and monitoring with Google Cloud's operations suite
8.1.1. Reviewing logs for networking components (e.g., VPN, Cloud Router, VPC Service Controls)
8.2. Monitoring networking components (e.g., VPN, Cloud Interconnect connections and interconnect attachments, Cloud Router, load balancers, Google Cloud Armor, Cloud NAT)
8.3. Managing and maintaining security
8.4. Firewalls (e.g., cloud-based, private)
8.5. Diagnosing and resolving IAM issues (e.g., Shared VPC, security/network admin)
8.6. Maintaining and troubleshooting connectivity issues
8.6.1. Draining and redirecting traffic flows with HTTP(S) Load Balancing
8.6.2. Monitoring ingress and egress traffic using VPC Flow Logs
8.6.3. Monitoring firewall logs and Firewall Insights
8.6.4. Managing and troubleshooting VPNs
8.6.5. Troubleshooting Cloud Router BGP peering issues
8.7. Monitoring, maintaining, and troubleshooting latency and traffic flow
8.8. Testing network throughput and latency
8.9. Diagnosing routing issues
8.10. Using Network Intelligence Center to visualize topology, test connectivity, and monitor performance
