I85PREP
⌘ K
GCP Network Engineer study materials
GCP Network Engineer study resources

GCP Network Engineer: Configure managed network services

GCP Network Engineer · Work through your exam, one topic at a time.

All guide sections

Configure managed network services

This domain covers Google-managed services that sit in front of, behind, or alongside your VPC: load balancers, CDN, DNS, NAT, and connectivity appliances. Expect questions on choosing the right load balancer and wiring health checks and firewall rules.

Core rules

  • Global external Application Load Balancer uses a global anycast VIP, URL maps, backend services, and managed certificates. Regional external Application Load Balancer keeps the VIP regional.
  • External proxy Network Load Balancer is for TCP/SSL proxy traffic; external passthrough Network Load Balancer preserves client IP and is regional. Internal passthrough Network Load Balancer is for private TCP/UDP.
  • Health checks come from Google ranges. Allow 35.191.0.0/16 and 130.211.0.0/22 in firewall rules for load balancer health checks.
  • Cloud CDN attaches to a backend service and caches content at Google edge locations. Use cache keys and TTLs deliberately.
  • Cloud DNS supports public zones, private zones, forwarding, and peering. Private zones require VPC authorization.
  • Cloud NAT and Cloud Router provide managed outbound NAT; Cloud Router also carries BGP for hybrid connectivity.
  • Use zonal NEGs for GKE pods and serverless NEGs for Cloud Run; backend services select the endpoint type.

Worked example

Expose a global web app with an external Application Load Balancer. Create a backend service with a managed instance group in two regions, attach a health check on port 8080, create a URL map, and attach a Google-managed certificate. Add a firewall rule allowing 35.191.0.0/16 and 130.211.0.0/22 to the backend VMs on 8080. Enable Cloud CDN on the backend service and set a cache TTL. Set a default backend and a host rule so requests resolve predictably. The global VIP routes users to the nearest healthy backend.

Traps

  • Using an internal load balancer for public users.
  • Forgetting health-check firewall rules, so all backends appear unhealthy.
  • Assuming Cloud CDN caches dynamic responses by default.
  • Creating a private DNS zone without authorizing the VPC.
  • Confusing proxy and passthrough load balancers when client IP preservation matters.