Read this the night before or on exam morning. It assumes you’ve studied the notes. It’s here to refresh, not to teach.
Exam day
- 50 to 60 multiple choice and multiple select questions in 2 hours. English or Japanese. Fee $200. Valid for 2 years. No prerequisites; 3+ years of experience with 1+ year designing on Google Cloud is recommended.
- Google does not publish a passing score and states no penalty for wrong answers, so never leave a question blank. Roughly 2 minutes per question; flag long scenarios and return.
- A new version of the exam (restructured and streamlined) went live on 24 April 2026. Its sections: designing and planning the VPC (about 21%), implementing the VPC (about 20%), managed network services (about 16%), hybrid and multicloud interconnectivity (about 16%), operations, monitoring and troubleshooting (about 14%), network security (about 13%).
How to read a question
Read the last sentence first, then hunt for the constraint words:
| The question says | Think |
|---|---|
| Global, anycast, single IP | Global external Application or proxy Network LB, Premium Tier |
| Preserve client IP, UDP, any port | Passthrough Network LB (regional) |
| Overlapping IP ranges | Private NAT or Private Service Connect |
| Transitive, hub, many VPCs | Network Connectivity Center, not peering |
| Least privilege on subnets | Compute Network User at subnet level |
| 99.99% | Four Interconnect connections across two metros; HA VPN with both tunnels |
| Encrypt over Interconnect | MACsec (Dedicated, line rate) or HA VPN over Interconnect |
| Cannot reach X | Connectivity Tests, then firewall, route, health check probe ranges |
Elimination: Classic VPN, target pools and Cloud Source Repositories style legacy answers are rarely right. Peering never transits. Firewalls are stateful and distributed. Cloud Router is control plane only.
Load balancers
| LB | Layer | Scope | Client IP at backend |
|---|---|---|---|
| Global external Application | 7 | Global | In X-Forwarded-For |
| Regional external / internal Application | 7 | Regional | In X-Forwarded-For |
| Cross-region internal Application | 7 | Multi-region, internal | In X-Forwarded-For |
| Global external proxy Network | 4 TCP/TLS | Global | PROXY protocol |
| Regional (internal / external) proxy Network | 4 TCP | Regional | PROXY protocol |
| External passthrough Network | 4 | Regional | Preserved |
| Internal passthrough Network | 4 | Regional (global access option) | Preserved; usable as route next hop |
- Probe ranges: 130.211.0.0/22 and 35.191.0.0/16. Envoy LBs also need a proxy-only subnet (/26 minimum, /23 recommended) allowed in firewall rules.
- Health check defaults: 5 s interval, 5 s timeout, 2 healthy, 2 unhealthy. Connection draining up to 3600 s (default 300 s). Backend timeout 30 s.
- Backend types: MIG, zonal NEG, serverless NEG, internet NEG, hybrid NEG, PSC NEG, backend bucket.
- Cloud CDN: global external Application LB only; cache modes CACHE_ALL_STATIC, USE_ORIGIN_HEADERS, FORCE_CACHE_ALL; invalidation is slow, so version your objects.
Hybrid connectivity
| Link | Capacity | Remember |
|---|---|---|
| HA VPN | ~3 Gbps per tunnel | IKEv2 only, two interfaces, 99.99% with both tunnels and redundant peer, BGP |
| Classic VPN | 99.9%, deprecated | |
| Dedicated Interconnect | 10 or 100 Gbps circuits | Colocation facility, LOA-CFA, VLAN attachments 50 Mbps to 50 Gbps |
| Partner Interconnect | 50 Mbps to 50 Gbps | Pairing key; layer 2 (you run BGP) vs layer 3 (partner runs BGP) |
| Cross-Cloud Interconnect | 10 or 100 Gbps | To AWS, Azure, Oracle, Alibaba |
| Direct / Verified Peering | Public Google services only, no VPC access |
- SLAs: 99.9% = two connections in different edge availability domains in one metro; 99.99% = four connections over two metros. Single connection: none.
- Cloud Router: private ASN 64512 to 65534 or 4200000000 to 4294967294; link-local 169.254.0.0/16; lower MED wins; BFD for fast failover; MD5 supported; keepalive 20 s, hold 60 s; global dynamic routing for multi-region.
- Custom advertisements are needed for PSC and PSA ranges, restricted/private.googleapis.com VIPs, peered VPC ranges and 35.199.192.0/19 (Cloud DNS forwarding).
- Best path selection: legacy (default) or standard BGP behavior.
Addresses, ranges and defaults
| Item | Value |
|---|---|
| Auto mode subnets | /20 per region from 10.128.0.0/9 |
| Reserved IPs per subnet | 4 |
| Default VPC MTU | 1460 (range 1300 to 8896) |
| Default internet route | 0.0.0.0/0 priority 1000 |
| Route selection | Longest prefix, then lowest priority, then ECMP |
| restricted.googleapis.com | 199.36.153.4/30 |
| private.googleapis.com | 199.36.153.8/30 |
| IAP TCP forwarding | 35.235.240.0/20 |
| Cloud DNS forwarding source | 35.199.192.0/19 |
| Serverless VPC Access connector subnet | /28 |
| Cloud NAT ports | 64,512 per IP; static default 64 per VM; dynamic min 32 |
| Cloud NAT timeouts | TCP established 1200 s, UDP and ICMP 30 s, TCP time-wait 120 s |
DNS and routing one-liners
- Resolution order in a VPC: response policy, private zone (most specific), internal DNS, public.
- Forwarding zone = cloud to on-premises; inbound policy = on-premises to cloud; peering zone = reuse another VPC’s view (not transitive); cross-project binding = one zone, many projects.
- Routing policies: WRR, geolocation, failover (uses internal LB health, trickle ratio).
- DNSSEC: public zones, DS record at the registrar.
- Peering: subnet routes by default; custom routes need export and import; non-transitive; no shared firewall rules.
- NCC: VPC, hybrid, router appliance, producer spokes; mesh vs star (edge cannot reach edge); include/exclude filters; Private NAT and PSC propagation.
- Policy-based routes beat regular routes; ILB next hop gives HA appliances.
Security one-liners
- Firewall order: org policy, folder policy, VPC rules and global network policy, regional policy, implied rules (deny ingress, allow egress).
goto_nextdelegates. - Selectors: network tags (weak) < service accounts < secure tags (IAM controlled).
- NGFW: Essentials, Standard (FQDN, geo, threat intel, address groups), Enterprise (IPS with TLS inspection).
- Cloud Armor: backend, edge (before CDN cache), network edge (passthrough, DDoS); lowest priority first; preview mode; sensitivity 0 to 4; throttle vs ban; Adaptive Protection; reCAPTCHA; threat intelligence.
- Secure Web Proxy for URL-level egress; Cloud NAT for outbound only; VPC-SC for API exfiltration (dry-run first).
- Packet Mirroring: collector is an internal passthrough NLB in the same region.
- Tools: Connectivity Tests (reachability), Network Analyzer (config risks), Firewall Insights (rule hygiene), Performance Dashboard (loss and latency), Network Topology, Flow Analyzer, VPC Flow Logs (default 50% sampling).