Manage, monitor, and troubleshoot network operations
This domain tests how you observe and diagnose network behavior: flow logs, firewall logs, connectivity tests, metrics, and topology. The exam wants evidence-driven troubleshooting, not guesswork. Start with the most specific test and widen only when the data requires it.
Core rules
- VPC Flow Logs record sampled flow data for subnet traffic. They help identify top talkers, denied flows, and egress patterns, but they are not packet captures.
- Firewall Rules Logging records connections that match a specific firewall rule. Enable it on the rules you need to audit; it is not a replacement for flow logs.
- Network Intelligence Center includes Connectivity Tests, Network Topology, Performance Dashboard, and Firewall Insights. Connectivity Tests simulate a path and report where traffic would be dropped.
- Cloud Monitoring collects metrics such as load balancer request counts, latency, and NAT allocation errors. Cloud Logging stores audit and data-plane logs.
- Packet Mirroring copies traffic from selected instances for deep inspection by third-party tools.
- Use Cloud Audit Logs for configuration changes and VPC Flow Logs for traffic behavior; combine them when a change and a symptom coincide.
Worked example
A VM cannot reach an on-premises server after a VPN change. Run a Connectivity Test from the VM to the on-premises IP. The test reports that the route exists but the firewall blocks egress on port 443. Check the egress rule priority and target tag. Then verify the BGP session on the Cloud Router and the advertised route for the on-premises prefix. Finally, inspect VPC Flow Logs for repeated denies and confirm the fix with a second Connectivity Test.
Traps
- Treating VPC Flow Logs as full packet capture.
- Looking only at ingress rules when egress is blocked.
- Forgetting that firewall rule logging must be enabled per rule.
- Assuming a BGP session is up means routes are advertised and accepted.
- Ignoring route priority and dynamic versus static routes.
- Using Performance Dashboard for packet-level analysis. Flow logs are aggregated and sampled, so absence is not proof.