GCP Network Engineer study plan

GCP Network Engineer · Give each week a clear focus.

8 weeks · About 7 hours per week

Week 1

Design and plan a Google Cloud Virtual Private Cloud (VPC) network

Map every VPC design primitive (subnets, secondary ranges, routes, firewall rule evaluation order, Shared VPC host/service project roles) into a one-page reference you can redraw from memory
Design three VPC topologies on paper: single-region single-VPC, multi-region with global load balancing, and Shared VPC with two service projects, and justify subnet sizing with CIDR math
Compare Private Service Connect, Private Google Access, and VPC peering for reaching managed services, and pick the right one for four given scenarios
Calculate usable IPs per subnet accounting for Google-reserved addresses and plan secondary ranges for GKE pods and services

A design document with three VPC topologies, CIDR allocation tables, and a decision matrix for private connectivity options

Week 2

Build a VPC in a sandbox project with custom-mode subnets in two regions, then add and verify secondary ranges
Configure hierarchical firewall policies and VPC firewall rules, then prove evaluation order with allow/deny test traffic
Create static and policy-based routes, and trace path selection when overlapping destinations exist
Set up Cloud NAT and verify egress behavior for instances without external IPs

A working sandbox VPC with documented terraform or gcloud commands, plus a traffic-test log showing firewall and route outcomes

Week 3

Deploy an external global Application Load Balancer across two regional backends and validate health checks and failover
Configure a regional internal proxy Network Load Balancer and confirm client traffic stays private
Enable Cloud DNS private zones and DNS peering, then resolve internal names from a peered VPC
Set up Cloud CDN on a backend service and verify cache hit behavior with response headers

A managed-services lab report with load balancer configs, DNS resolution evidence, and CDN cache-hit screenshots or logs

Week 4

Compare Dedicated Interconnect, Partner Interconnect, HA VPN, and Cross-Cloud Interconnect on SLA, bandwidth, and topology, and select one for three given requirements
Design an HA VPN with two tunnels and BGP, then document failover behavior when one tunnel drops
Configure Cloud Router with custom route advertisements and verify learned routes in the VPC
Plan a hub-and-spoke hybrid topology using Network Connectivity Center and list the tradeoffs versus VPC peering

A hybrid connectivity design with HA VPN topology diagram, BGP ASN plan, and a written failover test result

Week 5

Revisit any weak design areas from weeks 1-2 and rewrite your topology doc with corrections
Implement a Shared VPC with host and service projects and grant least-privilege subnet-level IAM
Migrate a standalone VPC workload into the Shared VPC model and verify connectivity
Audit your sandbox for CIDR overlaps and unused secondary ranges, then clean up

A refactored Shared VPC implementation with IAM bindings and a before/after connectivity verification

Week 6

Enable VPC Flow Logs with appropriate aggregation and sampling, then query them to identify top talkers
Configure uptime checks and alerting policies for a load-balanced service
Use Network Intelligence Center tools (Connectivity Tests, Network Topology) to diagnose a deliberately broken route
Build a troubleshooting runbook covering packet loss, DNS failures, and asymmetric routing symptoms

A monitoring and troubleshooting runbook with flow log queries, an alert policy, and a documented diagnosis of one injected fault

Week 7

Deploy Cloud Armor security policies with WAF rules and rate limiting, then test with simulated attack traffic
Configure VPC Service Controls perimeter around a storage and API resource and verify blocked access from outside
Implement Identity-Aware Proxy for SSH access and remove broad firewall rules
Design a layered security model combining firewall policies, private access, and inspection, and map it to a given threat scenario

A security implementation package with Cloud Armor policy, service perimeter, IAP config, and test evidence for each control

Week 8

Reconstruct your one-page design reference from week 1 without notes and close gaps
Walk through two end-to-end scenarios (hybrid migration and multi-tier secure app) and write the full solution architecture
Review every deliverable from weeks 1-7 and list unresolved weak spots with a fix plan
Complete a timed practice set and analyze misses by domain

A consolidated architecture portfolio with two end-to-end solutions and a prioritized remediation list

Week 2: You can build a two-region VPC with firewall and route rules from memory and explain evaluation order without notes

Week 4: You can design an HA VPN with BGP failover and justify the choice against Interconnect options for a stated requirement

Week 6: You can diagnose an injected network fault using Connectivity Tests and flow logs within 20 minutes

Week 8: You can produce a complete end-to-end architecture for a hybrid secure workload and score above 80% on a timed practice set