GCP Network Engineer flashcards
GCP Network Engineer · Build recall with a focused review session.
33 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Global VPC network
- A VPC network is a global resource spanning all regions. Subnets are regional, and a resource's region is set by the subnet it uses.
- Automatic mode VPC
- Creates one subnet per region with preset /20 ranges automatically. Convenient for quick starts but limits control over IP addressing and hybrid planning.
- Shared VPC host project
- The project that owns the VPC network and subnets. Service projects attach to it and deploy resources into shared subnets without owning the network.
- VPC peering transitivity
- Peering is non-transitive. If network A peers with B and B peers with C, A cannot reach C unless additional peering or a transit hub is configured.
- Private services access
- An allocated internal range peered to a service producer network, enabling private connectivity to managed services such as Cloud SQL without public IPs.
- Subnet range expansion
- A subnet's primary or secondary range can be expanded without recreating the subnet, but it can never be shrunk. Plan growth headroom carefully.
- Route priority tie-breaker
- When multiple routes match, the most specific prefix wins first. Route priority, where lower values win, breaks ties among equally specific routes.
- Stateful firewall rules
- VPC firewall rules are stateful. Return traffic for an allowed connection is automatically permitted, so no separate egress rule is needed for replies.
- Hierarchical firewall policies
- Firewall policies applied at organization or folder level. They are evaluated before project-level VPC firewall rules and enforce consistent controls across projects.
- Alias IP ranges
- Additional IP ranges assigned to a VM's network interface, commonly used for GKE pods and services. They are not separate NICs.
- Cloud NAT requirements
- Provides outbound-only internet access for private instances. Requires a Cloud Router in the same region and does not accept inbound connections.
- Serverless VPC Access connector
- A resource that lets Cloud Run and Cloud Functions reach private VPC addresses such as internal VM IPs and private service endpoints.
- Global external Application LB
- An HTTP/S load balancer with a global anycast VIP. Uses URL maps and backend services referencing MIGs, NEGs, or serverless NEGs.
- Cloud CDN cache modes
- Cache modes are USE_ORIGIN_HEADERS, CACHE_ALL_STATIC, and FORCE_CACHE_ALL. They control which responses Cloud CDN stores and serves.
- Cloud DNS private zone
- A managed zone visible only to authorized VPC networks. Used for internal names and hybrid resolution via DNS peering or forwarding policies.
- Cloud Router role
- A regional resource that runs BGP for VPN and Interconnect. It exchanges routes with peers but does not carry data traffic itself.
- Cloud Armor security policy
- Attaches to backend services and enforces IP allow/deny lists, geo-based rules, rate limiting, and preconfigured WAF rules for HTTP/S traffic.
- Health check scope
- Global load balancers use global health checks; regional load balancers use regional health checks. Health checks determine backend eligibility for traffic.
- HA VPN SLA
- High-availability VPN uses two interfaces and two tunnels, delivering a 99.99% SLA when configured with a Cloud Router and BGP.
- Dedicated Interconnect
- A direct physical connection at a colocation facility supporting 10 Gbps or 100 Gbps links, with VLAN attachments and BGP for routing.
- Partner Interconnect
- Connectivity through a supported service provider, useful when a colocation facility is not reachable or lower bandwidth than Dedicated Interconnect is needed.
- Network Connectivity Center
- A hub-and-spoke framework connecting VPC, VPN, and Interconnect spokes to enable transitive routing across networks and hybrid links.
- Cross-Cloud Interconnect
- Dedicated connectivity from Google Cloud to other clouds such as AWS or Azure through supported partner locations, configured with VLAN attachments and BGP.
- BGP MED failover
- Multi-Exit Discriminator influences path selection. Google Cloud commonly uses MED to achieve active/passive failover between redundant hybrid links.
- VPC Flow Logs
- Sampled flow records captured at the subnet level, including source, destination, port, protocol, bytes, and round-trip time. Exported to Cloud Logging.
- Firewall Rules Logging
- Records allow and deny decisions per firewall rule. Enabled on individual rules rather than per subnet, and exported to Cloud Logging.
- Connectivity Tests
- A Network Intelligence Center tool that simulates a packet path and reports where traffic is dropped due to firewall, route, or configuration issues.
- Packet Mirroring
- Copies traffic from selected instances to a collector for deep inspection. Requires a load balancer frontend and a mirroring policy.
- Cloud Router BGP metrics
- Session status and learned versus advertised route counts indicate hybrid connectivity health. Drops in learned routes often signal a BGP or tunnel failure.
- VPC Service Controls
- Creates a service perimeter restricting Google API data access to authorized networks and identities, helping prevent data exfiltration.
- Identity-Aware Proxy
- Enforces identity and context checks before granting access to web apps and to SSH or RDP sessions via TCP forwarding, without public IPs.
- Private Service Connect
- Lets consumers reach producer services through private endpoints without VPC peering, avoiding CIDR overlap and transitive routing limits.
- Service account firewall targets
- Firewall rules targeting service accounts are identity-based and tamper-resistant compared with network tags, which any instance owner can add.