I85PREP
⌘ K
GCP Network Engineer study materials
GCP Network Engineer study resources

GCP Network Engineer: Implement a VPC network

GCP Network Engineer · Work through your exam, one topic at a time.

All guide sections

Implement a VPC network

Implementation questions test whether you can build the design correctly with routes, firewall rules, NAT, DNS, and logging. The exam favors concrete configuration choices over product marketing, so know which object applies at which scope.

Core rules

  • Create custom-mode VPCs and regional subnets with explicit primary and secondary ranges. Enable Private Google Access on subnets that host VMs without external IPs.
  • Firewall rules are stateful, evaluated by priority with the lowest number first. Ingress rules can target tags or service accounts; egress rules can target tags or service accounts. The implied rules deny all ingress and allow all egress.
  • Hierarchical firewall policies attach at organization or folder level and are evaluated before VPC firewall rules. Use them for mandatory controls.
  • Cloud NAT provides outbound internet for VMs without external IPs. It requires a Cloud Router in the same region and applies to the subnets you select; it does not provide inbound access.
  • Cloud DNS private zones are visible to authorized VPCs. DNS peering and forwarding connect private namespaces without exposing them publicly.
  • Enable VPC Flow Logs on subnets for traffic visibility; enable Firewall Rules Logging on specific rules when you need connection-level decisions.

Worked example

A private VM in us-central1 must reach pypi.org but has no external IP. Create a Cloud Router in us-central1, attach a Cloud NAT gateway to the subnet, and allow egress with a firewall rule. Because the VM also calls Google APIs, enable Private Google Access on the subnet. Add a private DNS zone for internal.example.com and authorize the VPC. Do not add an ingress allow rule from 0.0.0.0/0; NAT is outbound only.

Traps

  • Creating a NAT gateway without a Cloud Router in the same region.
  • Expecting Cloud NAT to allow inbound connections.
  • Writing a firewall rule with a target tag that no VM carries.
  • Assuming firewall rules are stateless and adding reverse rules unnecessarily.
  • Forgetting that implied egress allow can mask missing explicit egress controls.
  • Confusing VPC Flow Logs with packet capture; it is aggregated flow data.