I85PREP
⌘ K
GCP Network Engineer study materials
GCP Network Engineer study resources

GCP Network Engineer: Configure, implement, and manage a cloud network security solution

GCP Network Engineer · Work through your exam, one topic at a time.

All guide sections

Configure, implement, and manage a cloud network security solution

This domain tests network security controls in and around the VPC: firewall policy hierarchy, Cloud Armor, private access, and service perimeters. Expect questions on where a control applies and what it cannot protect.

Core rules

  • Hierarchical firewall policies apply at organization or folder level and are evaluated before VPC firewall rules. Use them for baseline deny and allow controls that must not be overridden by project owners.
  • VPC firewall rules are stateful and priority-ordered. Target by tag or service account. Prefer service accounts for identity-based targeting and tags for role-based targeting.
  • Cloud Armor protects external Application Load Balancers and external proxy Network Load Balancers. It supports WAF rules, IP allow and deny lists, and rate limiting; it does not protect internal load balancers.
  • Identity-Aware Proxy controls access to web apps and SSH or RDP without exposing public IPs. Use IAP TCP forwarding for administrative access.
  • Private Service Connect lets consumers reach Google APIs, published services, or managed services through private endpoints without public IPs.
  • VPC Service Controls create a service perimeter around Google Cloud services to reduce data exfiltration risk.

Worked example

Protect a public web app behind an external Application Load Balancer. Create a Cloud Armor security policy with a rate-limit rule and a WAF rule for SQL injection, then attach it to the backend service. Add a hierarchical firewall policy at the folder level to deny ingress from 0.0.0.0/0 to management ports, and a VPC rule allowing only IAP TCP forwarding range 35.235.240.0/20 to SSH. Put the sensitive project in a VPC Service Controls perimeter. Verify that Cloud Armor is attached to the correct backend service, not just created.

Traps

  • Attaching Cloud Armor to an internal load balancer.
  • Creating a firewall rule but not attaching the policy to the target.
  • Assuming tags are global across VPCs; network tags are scoped to the network and instance.
  • Using 0.0.0.0/0 allow rules for SSH instead of IAP.
  • Believing VPC Service Controls replace firewall rules; they address service-level exfiltration.
  • Forgetting that hierarchical policies can override project-level intent.