Google Cloud – Professional Cloud Network Engineer Certification Learning Path

Google Cloud – Professional Cloud Network Engineer certification exam focuses on the design, implementation, and management of Google Cloud network infrastructure. This includes designing network architectures for high availability, scalability, resiliency, and security.

Google Cloud – Professional Cloud Network Engineer Certification Summary

• Has 50-60 questions to be answered in 2 hours.
• Registration fee: $200 (plus tax where applicable)
• Available in English and Japanese
• Delivered through Pearson VUE — online-proctored or at a testing center
• Covers a wide range of Google Cloud services mainly focusing on network services
• Recommended experience: 3+ years of industry experience including 1+ years designing and managing solutions using Google Cloud
• Hands-on is a MUST — if you have not worked on GCP before, make sure you do lots of labs else you would be absolutely clueless for some of the questions and commands
• The exam assesses your ability to:
  • Design and plan a Google Cloud Virtual Private Cloud (VPC) network
  • Implement a VPC network
  • Configure managed network services
  • Configure and implement hybrid and multi-cloud network interconnectivity
  • Manage, monitor, and troubleshoot network operations
  • Configure, implement, and manage a cloud network security solution

Google Cloud – Professional Cloud Network Engineer Certification Resources

• Courses
  • Google Cloud Skills Boost – Professional Cloud Network Engineer Learning Path (Official Google Cloud training)
  • Coursera – Google Cloud Networking Professional Certificate
  • Coursera – Networking in Google Cloud which includes
    • Networking in Google Cloud: Hybrid Connectivity and Network Management
    • Networking in Google Cloud: Defining and Implementing Networks
  • Coursera – Hands-On Labs in Google Cloud for Networking Engineers
  • A Cloud Guru – Google Cloud Certified – Professional Cloud Network Engineer (A Cloud Guru shut down November 2025; content migrated to Pluralsight)
• Practice tests
  • Official Google Cloud Sample Questions
  • Braincert Google Cloud Certified – Professional Cloud Network Engineer Practice Exams
• Use Google Cloud Free Tier and Google Cloud Skills Boost (formerly Qwiklabs) as much as possible.
• Official Resources:
  • Exam Guide (Updated April 2025)
  • Google Cloud Documentation
  • Google Cloud Solutions

Google Cloud – Professional Cloud Network Engineer Certification Topics

Network Services

• Refer Google Cloud Networking Services Cheat Sheet
• Virtual Private Cloud
  • Understand Virtual Private Cloud (VPC), subnets, and host applications within them
  • VPC Routes determine the next hop for the traffic. HINT: It can be defined for specific tags as well. More specific takes priority.
  • Firewall rules control the traffic to and from instances. HINT: Rules with lower integers indicate higher priorities. Firewall rules can be applied to specific tags or service accounts.
  • Cloud Next Generation Firewall (Cloud NGFW) — The modern firewall management framework that includes:
    • Hierarchical firewall policies — Applied at organization and folder levels for consistent enforcement across multiple VPC networks
    • Network firewall policies — Applied at VPC network level, replacing legacy VPC firewall rules
    • Cloud NGFW Enterprise (powered by Palo Alto Networks) — Provides intrusion detection/prevention (IDS/IPS) and TLS inspection
    • HINT: Understand the evaluation order — Hierarchical policies → Network policies → VPC firewall rules. “goto_next” action delegates to the next level.
  • VPC Peering allows internal or private IP address connectivity across two VPC networks regardless of whether they belong to the same project or the same organization. HINT: VPC Peering uses private IPs and does not support transitive peering
  • Shared VPC allows an organization to connect resources from multiple projects to a common VPC network so that they can communicate with each other securely and efficiently using internal IPs from that network HINT: VLAN attachments and Cloud Routers for Interconnect must be created in the host project
  • Understand the concept of internal and external IPs and the difference between static and ephemeral IPs
  • VPC Subnets support primary and secondary (alias) IP range
  • Primary IP range of an existing subnet can be expanded by modifying its subnet mask, setting the prefix length to a smaller number.
  • Private Access options for services allow instances with internal IP addresses to communicate with Google APIs and services.
  • Private Google Access allows VMs to connect to the set of external IP addresses used by Google APIs and services by enabling Private Google Access on the subnet used by the VM’s network interface. HINT: Private Google Access is enabled on the subnet and not on the VPC level
  • Private Service Connect — Allows consumers to access managed services privately from inside their VPC network using an internal IP endpoint. Supports accessing Google APIs, published services, and third-party services (e.g., Elastic, MongoDB, Snowflake). HINT: PSC provides an alternative to VPC peering with better security isolation and no shared scaling dependencies.
  • VPC Flow Logs records a sample of network flows sent from and received by VM instances, including instances used as GKE nodes.
  • Firewall Rules Logging enables auditing, verifying, and analyzing the effects of the firewall rules HINT: Default implicit ingress deny rule is not captured by firewall rules logging. Add an explicit deny rule
  • Resources within a VPC network can communicate with one another by using internal IPv4 addresses
  • IPv6 Support — VPC networks and subnets support dual-stack (IPv4 and IPv6) configuration. Understand internal IPv6 (ULA) and external IPv6 (GUA) addressing.
• Hybrid Connectivity
  • Understand Hybrid Connectivity options
• Cloud VPN
  • Cloud VPN provides secure connectivity from the on-premises data center to the GCP network through the public internet. Cloud VPN does not provide internal or private IP connectivity
  • Understand what are the requirements to setup Cloud VPN.
  • Cloud VPN is quick to setup and test hybrid connectivity
  • Understand limitations of Cloud VPN esp. 3Gbps limit per tunnel. How it can be improved with multiple tunnels.
  • Cloud VPN requires non overlapping primary and secondary IPs address between on-premises and GCP VPC networks
  • Cloud VPN HA provides a highly available and secure connection between the on-premises and the VPC network through an IPsec VPN connection in a single region
  • HA VPN IPv6 Support — HA VPN now supports dual-stack (IPv4_IPV6) and IPv6-only gateway types. Multiprotocol BGP (MP-BGP) enables exchanging IPv6 routes over IPv4 BGP sessions and vice versa.
  • Classic VPN Dynamic Routing Deprecation (August 1, 2025): BGP/dynamic routing for Classic VPN tunnels is deprecated. If your workloads require BGP for VPN connectivity, you must use HA VPN. Classic VPN only supports policy-based and route-based (static) configurations going forward.
• Cloud Interconnect
  • Cloud Interconnect provides direct connectivity from the on-premises data center to GCP network
  • Dedicated Interconnect provides a direct physical connection between the on-premises network and Google’s network. Supports 10 Gbps or 100 Gbps connections (400G announced at Cloud Next ’25 for AI workloads)
  • Partner Interconnect provides connectivity between the on-premises and VPC networks through a supported service provider. Supports 50Mbps to 50 Gbps
  • Understand Dedicated Interconnect vs Partner Interconnect and when to choose
  • Know Interconnect as the reliable high speed, low latency, and dedicated bandwidth option.
  • Cloud Monitoring monitors interconnect links. Circuit Operational Status metric threshold tracks the circuits while Interconnect Operational Status metric tracks all the links
  • Cross-Cloud Interconnect — Provides high-bandwidth dedicated connectivity between Google Cloud and another cloud provider (AWS, Azure, Oracle Cloud). Enables building multicloud architectures with private, SLA-backed connections. HINT: Use Cross-Cloud Interconnect for multicloud connectivity; use Dedicated/Partner Interconnect for on-premises connectivity.
  • Cross-Site Interconnect (GA) — Transparent, on-demand Layer 2 connectivity between on-premises sites leveraging Google’s global infrastructure.
• Cloud Router
  • Cloud Router provides dynamic routing using BGP with HA VPN and Cloud Interconnect
  • Cloud Router Global routing mode provides visibility to resources in all regions
  • Cloud Router uses Multi-exit Discriminator (MED) value to route traffic. The same MED value results in Active/Active connection and different MED results in Active/Passive connection
  • Supports Multiprotocol BGP (MP-BGP) for exchanging IPv4 and IPv6 routes over a single BGP session
• Network Connectivity Center
  • Network Connectivity Center (NCC) provides a hub-and-spoke model for network connectivity management in Google Cloud
  • Supports VPC spokes for inter-VPC connectivity without needing VPC peering
  • Supports hybrid spokes (Cloud VPN, Interconnect VLAN attachments, Router appliances) for connecting on-premises and other cloud networks
  • Enables using Google’s network as a wide area network (WAN) for data transfer between on-premises or multi-cloud sites
  • HINT: NCC provides transitive connectivity through the hub, overcoming VPC peering’s non-transitive limitation
• Cloud NAT
  • Cloud NAT allows VM instances without external IP addresses and private GKE clusters to send outbound packets to the internet and receive any corresponding established inbound response packets.
  • Requests would not be routed through Cloud NAT if they have an external IP address
• Cloud Peering
  • Google Cloud Peering provides Direct Peering and Carrier Peering
  • Peering provides a direct path from the on-premises network to Google services, including Google Cloud products that can be exposed through one or more public IP addresses — does not provide a private dedicated connection
• Cloud Load Balancing
  • Google Cloud Load Balancing provides scaling, high availability, and traffic management for your internet-facing and private applications.
  • Understand Google Load Balancing options and their use cases — which is global/regional, external/internal, and what protocols they support.
  • Updated Load Balancer Naming (2023+):
    • Application Load Balancer (formerly HTTP(S) Load Balancer) — Layer 7, supports HTTP/HTTPS/HTTP2/HTTP3(QUIC)
      • Global external Application Load Balancer
      • Regional external Application Load Balancer
      • Cross-region internal Application Load Balancer
      • Regional internal Application Load Balancer
    • Proxy Network Load Balancer (formerly TCP/SSL Proxy Load Balancer) — Layer 4 proxy
      • Global external proxy Network Load Balancer
      • Regional external proxy Network Load Balancer
      • Cross-region internal proxy Network Load Balancer
      • Regional internal proxy Network Load Balancer
    • Passthrough Network Load Balancer (formerly Network Load Balancer / Internal TCP/UDP LB) — Layer 4, pass-through
      • External passthrough Network Load Balancer — regional, external
      • Internal passthrough Network Load Balancer — regional, internal
  • Cloud Load Balancing supports health checks with managed instance groups
• Cloud CDN
  • Understand Cloud CDN as the global content delivery network
  • Know CDN works with global external Application Load Balancer (formerly HTTP(S) LB)
  • Media CDN — Optimized for large-scale media delivery (video streaming, gaming downloads). Separate from Cloud CDN.
  • Cache is not removed if the underlying origin data is removed. Cache has to be invalidated explicitly, or is removed once expired.
  • Cloud CDN does not compress but serves response from the origin as is. HINT: As LB adds Via header some web server do not compress response and must be configured to ignore the Via header
• Cloud DNS
  • Understand Cloud DNS and its features
  • Supports migration or importing of records from on-premises using JSON/YAML format
  • Supports DNSSEC, a feature of DNS, that authenticates responses to domain name lookups and protects the domains from spoofing and cache poisoning attacks
  • Supports DNS routing policies (weighted round-robin, geolocation, failover)

Identity Services

• Cloud Identity and Access Management
  • Identify and Access Management – IAM provides administrators the ability to manage cloud resources centrally by controlling who can take what action on specific resources.
  • Compute Network Admin does not provide access to SSL certificates and firewall rules. Need to assign Security Admin role
  • Understand IAM-governed tags for firewall policy rules (replacing network tags for newer policies)

Compute Services

• Compute services like Google Compute Engine and Google Kubernetes Engine are lightly covered more from the networking aspects
• Google Compute Engine
  • Google Compute Engine is the best IaaS option for compute and provides fine grained control
  • Difference between managed vs unmanaged instance groups and auto-healing feature
  • Regional Managed Instance group helps spread load across instances in multiple zones within the same region providing scalability and HA
  • Managed Instance group helps perform canary and rolling updates
  • Managed Instance group autoscaling can be configured on CPU or load balancer metrics or custom metrics.
  • Managing access using OS Login or project and instance metadata
• Google Kubernetes Engine
  • Google Kubernetes Engine, powered by the open-source container scheduler Kubernetes, enables you to run containers on Google Cloud Platform.
  • Understand GKE Networking in detail
  • Understand GKE Cluster types based on networking — VPC-Native clusters (recommended, uses alias IPs) vs Routes-based clusters (legacy)
  • Understand GKE VPC-Native cluster IP Allocation
  • Private clusters help isolate nodes from having inbound and outbound connectivity to the public internet by providing nodes with internal IP addresses only.
  • GKE Dataplane V2 — eBPF-based dataplane providing better network policy enforcement, observability, and performance

Security Services

• Cloud Armor
  • Cloud Armor protects applications from multiple types of threats, including DDoS attacks and application attacks like XSS and SQLi
  • Cloud Armor Enterprise (formerly Managed Protection Plus) — Provides advanced DDoS protection, Adaptive Protection, threat intelligence, and bot management with insurance-backed DDoS protection
  • Adaptive Protection — ML-based detection of L7 DDoS attacks that automatically suggests and can auto-deploy mitigation rules
  • Works with global external Application Load Balancer; with GKE needs to be configured with GKE Ingress
  • Can be used to block/allow IPs, geolocation-based access control, rate limiting, and bot management
  • Supports preview mode to understand patterns without blocking the users
  • Supports preconfigured WAF rules for OWASP Top 10
  • Google Threat Intelligence integration for IP reputation feeds
• Secure Web Proxy
  • Secure Web Proxy is a cloud-first, secure web gateway that helps monitor and secure egress web traffic (HTTP/HTTPS)
  • Provides URL filtering, TLS inspection, and logging for outbound traffic from VMs and GKE pods
  • Replaces the need for third-party proxy appliances for egress filtering
  • HINT: Secure Web Proxy is for egress traffic control; Cloud Armor is for ingress traffic protection
• VPC Service Controls
  • Creates security perimeters around Google Cloud resources to mitigate data exfiltration risks
  • Restricts access to Google Cloud services and resources within defined perimeters
  • HINT: VPC Service Controls protect against data exfiltration from Google Cloud services, not network-level traffic

Network Monitoring and Operations

• Network Intelligence Center
  • Provides a comprehensive network monitoring, verification, and optimization platform
  • Connectivity Tests — Diagnoses connectivity issues between source and destination endpoints
  • Performance Dashboard — Monitors network performance metrics (latency, packet loss) across Google Cloud
  • Network Topology — Visualizes the network infrastructure and traffic flows
  • Firewall Insights — Identifies overly permissive or shadowed firewall rules
• Cloud Logging and Monitoring
  • VPC Flow Logs, Firewall Rules Logging, Cloud NAT logs, and DNS logs for network troubleshooting
  • Cloud Monitoring for setting up alerts on network metrics

All the Best !!