GCP Network Engineer key terms

A global, software-defined network in Google Cloud that hosts subnets, routes, and firewall rules across regions. It is a distinct resource from a subnet, which is regional.

A regional range of internal IP addresses within a VPC network. Instances and load balancer backends draw addresses from it, and its primary range defines the subnet's region.

An additional CIDR block attached to a subnet, used for alias IPs such as GKE pod and service ranges. It is not a separate subnet and cannot be moved between subnets.

A range of internal IPs assigned to a VM's network interface from a subnet's secondary range. Containers and services use these addresses without consuming primary subnet IPs.

A VPC routing mode where Cloud Router learns and distributes routes across all regions of the VPC. It contrasts with regional mode, which confines learned routes to one region.

A VPC network created without automatically generated subnets, so you define every subnet and its CIDR range yourself. Recommended for production because it avoids overlapping with existing networks.

A VPC network that automatically creates one subnet per region from a fixed set of predefined ranges. Convenient for quick starts but prone to CIDR overlap and limited flexibility.

The up-front allocation of non-overlapping CIDR blocks for subnets, pods, services, and on-premises networks. Overlaps break peering and hybrid connectivity and are hard to fix after deployment.

A host project owns subnets and shares them with attached service projects, letting central networking teams control IP space and policy while app teams deploy resources.

The project that owns the VPC network and subnets in a Shared VPC setup. It enables the Shared VPC API and grants subnet-level IAM to service project principals.

A project attached to a Shared VPC host that deploys resources into the host's shared subnets. It cannot administer the host network unless separately granted IAM roles.

A private connection between two VPC networks, local or across projects and organizations, that exchanges traffic over internal IPs. It is non-transitive, so peered networks cannot reach each other's peers.

The ability for traffic to pass through one peering to reach a third network. VPC peering does not support it, so hub-and-spoke designs usually need Network Connectivity Center or a shared VPC.

A stateful VPC-level rule that permits or denies traffic to or from instances based on direction, priority, source or destination, protocol, and port, plus target tags or service accounts.

A policy attached to an organization or folder that is evaluated before VPC firewall rules, letting administrators enforce baseline allow and deny behavior across many projects.

A rule inside a network or hierarchical firewall policy, evaluated in priority order. Policies allow centralized, delegated management of firewall behavior without editing each VPC.

Google Cloud's firewall service built on firewall policies, adding threat prevention, geo-location filtering, and address group support beyond classic VPC firewall rules.

A named, reusable collection of IP addresses or ranges referenced in firewall policy rules. Updating the group updates enforcement everywhere it is referenced.

A managed service that lets instances without external IPs initiate outbound internet connections through a NAT gateway. It is regional, handles only outbound-initiated traffic, and needs Cloud Router.

A subnet setting that lets VMs with only internal IPs reach Google APIs and services using private routing, without a NAT gateway or external address.

A mechanism to consume Google or third-party services through a private endpoint in your VPC, or to publish your own service to consumers, using internal IPs and producer/consumer attachments.

The producer-side resource in Private Service Connect that exposes a load balancer to consumer VPCs, which connect to it through an endpoint.

A family of managed load balancers, global or regional and external or internal, that distribute traffic to backends using forwarding rules and backend services.

The load balancer component that defines backends, health checks, and traffic distribution settings. It is referenced by a forwarding rule or URL map.

A load balancer resource binding an IP address and port to a target proxy or backend service. It is the entry point clients connect to.

A periodic probe that determines whether a backend is eligible to receive traffic. Load balancers use it to remove unhealthy endpoints automatically.

A managed authoritative DNS service hosting public and private zones. Private zones answer names only for authorized VPC networks.

A Cloud DNS configuration that lets a VPC network resolve names from a private zone owned by another network, without sharing the zone's VPC.

A Cloud DNS zone visible only to the VPC networks it is authorized for. It typically holds internal names and records for private resources.

A managed BGP speaker used by Cloud Interconnect and Cloud VPN to exchange routes dynamically between a VPC network and external networks.

An IPsec VPN service connecting on-premises or other clouds to a VPC network over the internet. HA VPN provides 99.99% availability with two tunnels on two interfaces.

A Cloud VPN topology with two interfaces and two tunnels to a peer gateway, offering a 99.99% SLA. It requires dynamic routing with Cloud Router.

A direct physical connection between an on-premises network and Google's network at a colocation facility, offering high bandwidth and lower latency than VPN.

A connection to Google Cloud through a supported service provider rather than a direct colocation link, useful when you cannot meet Dedicated Interconnect requirements.

A logical link on a Cloud Interconnect connection that carries traffic for one VPC network and region, paired with a Cloud Router for BGP.

A hub-and-spoke service for connecting VPC networks, VPNs, and Interconnect attachments transitively, solving the non-transitivity limitation of VPC peering.

A per-subnet feature that records sampled network flows to Cloud Logging, supporting traffic analysis, forensics, and cost review.

A per-rule setting that logs connections matched by a firewall rule, showing source, destination, port, and allow or deny outcome for auditing.

A suite of network observability tools including Connectivity Tests, Network Topology, and Performance Dashboard for validating and monitoring VPC connectivity.

A Network Intelligence Center tool that simulates traffic between endpoints and reports whether configuration such as routes, firewall rules, or peering allows it.