Google Cloud Professional Cloud Network Engineer Exam Prep

What's inside

1. Level 1: How the Network Engineer Exam WorksFree
   [Exam craft] Explains the exam: the six sections of Google's April 2026 exam guide and their weights, the scenario 'best answer' style of question, and how this course maps to the guide. The guide is Google's own document, free on the certification page, and is not reproduced here. This course is independent of Google, not endorsed by it, and does not promise a pass.
2. Level 2: Network Tiers, High Availability and ScaleFree
   [Section 1: Designing and planning a Google Cloud VPC network] Covers network tiers and designing for availability under 1.1. Compares Premium Tier and Standard Tier and how each choice affects global load balancing, and covers designing for high availability, failover, disaster recovery and scale across zones and regions.
3. Level 3: Choosing the Right Load Balancer
   [Section 1: Designing and planning a Google Cloud VPC network] Covers choosing a load balancer at design time under 1.1. Builds a decision path through external vs internal, global vs regional, and Application vs proxy Network vs passthrough Network Load Balancers, so the learner can pick the right Cloud Load Balancing product for a requirement.
4. Level 4: IAM Roles and Quotas for Network Designs
   [Section 1: Designing and planning a Google Cloud VPC network] Covers the IAM and quota items in 1.1. Explains which predefined roles fit which network designs (Compute Network Admin, Network User, Security Admin, Load Balancer Admin, Shared VPC Admin), applying least privilege, and how to plan for per-network, per-project and peering-group quotas and limits.
5. Level 5: VPC Type, Quantity and Global vs Regional
   [Section 1: Designing and planning a Google Cloud VPC network] Covers the 1.2 choices about VPC type and scope. Decides between standalone VPCs and Shared VPC, how many VPC environments to build (for example prod, non-prod and shared services), and when a global network design, a regional one or a mix fits the requirements.
6. Level 6: Interconnecting VPCs: Peering, NCC and PSC
   [Section 1: Designing and planning a Google Cloud VPC network] Covers how networks interconnect under 1.2 and how on-premises sites reach multiple VPCs under 1.3. Contrasts VPC Network Peering, Network Connectivity Center mesh and star topologies, and Private Service Connect, including peering's lack of transitivity.
7. Level 7: IP Address Management Strategy
   [Section 1: Designing and planning a Google Cloud VPC network] Covers the IPAM items in 1.2 and 1.3. Plans subnets, IPv6, bring your own IP (BYOIP), privately used public IP (PUPI), non-RFC 1918 ranges, ranges for managed services, internal ranges and IPAM automation, and uses Private NAT to deal with overlapping on-premises and cloud space.
8. Level 8: MTU Sizing for VPC and Hybrid Links
   [Section 1: Designing and planning a Google Cloud VPC network] Covers the MTU items in 1.2 and 1.3. Explains how to size the maximum transmission unit for a VPC and for its workloads, and how Cloud Interconnect and HA VPN MTU limits, including IPsec overhead, affect fragmentation and throughput.
9. Level 9: Inserting Network Virtual Appliances
   [Section 1: Designing and planning a Google Cloud VPC network] Covers third-party device insertion under 1.2. Designs network virtual appliance placement using custom static routes, policy-based routes and internal passthrough Network Load Balancers for high availability.
10. Level 10: Designing Hybrid and Multicloud Connectivity
    [Section 1: Designing and planning a Google Cloud VPC network] Covers the 1.3 connectivity design items. Chooses among Dedicated Interconnect, Partner Interconnect, Cloud VPN, SD-WAN appliances and Cross-Cloud Interconnect for bandwidth and security needs, decides between Direct Peering and a Verified Peering Provider, and covers multi-region HA with regional or global dynamic routing mode and the encryption options (MACsec and HA VPN over Cloud Interconnect).
11. Level 11: Designing DNS and Hybrid DNS Topology
    [Section 1: Designing and planning a Google Cloud VPC network] Covers DNS topology design under 1.1 and hybrid DNS architecture under 1.3. Defines forwarding paths between on-premises resolvers and Cloud DNS, inbound server policies, cross-project binding and a DNS peering strategy.
12. Level 12: Private Access to Managed Services and APIs
    [Section 1: Designing and planning a Google Cloud VPC network] Covers managed-service connectivity planning under 1.1 and the private-access items in 1.3. Compares private services access (VPC Network Peering), Private Service Connect and Serverless VPC Access, and covers reaching Google APIs such as Vertex AI privately from on-premises.
13. Level 13: Designing GKE Networking
    [Section 1: Designing and planning a Google Cloud VPC network] Covers GKE planning under 1.1 and designing for GKE under 1.4. Chooses public or private nodes and node pools, public or private control plane endpoints and control plane access, plans primary and secondary ranges and Pod and Service sizing (RFC 1918, non-RFC 1918, Google-managed services range, PSC, shared ranges, PUPI), and covers IPv6, load balancing and node pool configuration.
14. Level 14: Building VPC Resources with gcloud and Console
    [Section 2: Implementing a VPC network] Covers creating VPC resources under 2.1. Builds custom-mode networks, subnets, VPC firewall rules and network firewall policies, a private services access range, and private pools, then expands a subnet's primary range after creation.
15. Level 15: Configuring VPC Network Peering
    [Section 2: Implementing a VPC network] Covers configuring VPC Network Peering under 2.1 and custom route import and export over peering under 2.2. Sets up both sides of a peering and controls which custom and subnet routes are exchanged.
16. Level 16: Shared VPC and Service Project IAM
    [Section 2: Implementing a VPC network] Covers the 2.1 items on creating a Shared VPC network, sharing subnets and assigning IAM permissions. Enables a host project, attaches service projects, and grants Compute Network User at project or subnet level, including the service accounts GKE needs.
17. Level 17: Private Google Access and Public Interfaces
    [Section 2: Implementing a VPC network] Covers configuring access to Google APIs and Google-managed services under 2.1. Enables Private Google Access on subnets, sets up the DNS and routes for private.googleapis.com and restricted.googleapis.com, and decides when to use public interfaces instead.
18. Level 18: Configuring VPC Service Controls Perimeters
    [Section 2: Implementing a VPC network] Covers configuring restricted Google Cloud services with VPC Service Controls perimeters under 2.1. Builds an access policy and a service perimeter, uses dry-run mode, and adds access levels and ingress and egress rules.
19. Level 19: Static and Dynamic Routing Basics
    [Section 2: Implementing a VPC network] Covers the 2.2 items on static and dynamic routing with Cloud Router, global or regional dynamic routing, and routing with network tags and priority. Creates custom static routes, sets a VPC's dynamic routing mode and controls route selection.
20. Level 20: Policy-Based Routing and ILB as Next Hop
    [Section 2: Implementing a VPC network] Covers the 2.2 items on route priorities under global dynamic routing, policy-based routing, and an internal load balancer as next hop. Builds policy-based routes and next-hop-ILB routes that send traffic through appliances, and shows how they rank against dynamic routes.
21. Level 21: Configuring Network Connectivity Center for VPCs
    [Section 2: Implementing a VPC network] Serves 2.3: you build a Network Connectivity Center hub with gcloud and the console. It covers the differences between VPC spokes, hybrid spokes and producer spokes, and how to choose a mesh or star topology. It also covers IP/CIDR range filters on spokes, Private NAT and PSC propagation, and how to monitor and troubleshoot the hub's route table.
22. Level 22: GKE VPC-native clusters, Pod and Service ranges
    [Section 2: Implementing a VPC network] Serves 2.4: you create VPC-native GKE clusters that use alias IPs, and size and assign Pod and Service secondary ranges. You also add more Pod ranges to a running cluster and set up clusters in a Shared VPC service project, with the host-project permissions that requires.
23. Level 23: GKE private clusters and control plane access
    [Section 2: Implementing a VPC network] Serves 2.4: you lock down how nodes and administrators reach a GKE cluster. Topics are private nodes, private control plane endpoints, authorized networks, and the DNS-based endpoint for control plane access, with the trade-offs the exam tests for each.
24. Level 24: GKE dataplane: Dataplane V2, policies, SNAT, DNS
    [Section 2: Implementing a VPC network] Serves 2.4: you set up how traffic moves inside the cluster. Topics are GKE Dataplane V2, GKE network policies, source NAT (SNAT) and IP Masquerade policies, and cluster DNS choices: kube-dns, Cloud DNS for GKE and NodeLocal DNSCache.
25. Level 25: Choosing the right Cloud Load Balancer
    [Section 3: Configuring managed network services] Serves 3.1: you choose a Cloud Load Balancing product along three lines: internal or external, regional or global, and application, proxy or passthrough. You also learn which of these are tied to Premium or Standard network tier.
26. Level 26: Backend services, NEGs and autoscaled MIGs
    [Section 3: Configuring managed network services] Serves 3.1: you set up backend services with managed instance groups and autoscaling. You also set them up with network endpoint groups (zonal, serverless, internet, hybrid connectivity and PSC NEGs), and set serving capacity on each backend.
27. Level 27: Balancing modes, affinity, health checks, URL maps
    [Section 3: Configuring managed network services] Serves 3.1: you tune backend settings: balancing method, session affinity, health checks and URL maps. You also turn on global access for internal load balancers, and learn which firewall rules the health check probe ranges need.
28. Level 28: Load balancers in GKE: Gateway, Ingress, NEGs
    [Section 3: Configuring managed network services] Serves 3.1: you expose GKE workloads through Cloud Load Balancing with the GKE Gateway controller and the GKE Ingress controller. You learn how container-native load balancing with NEGs differs from instance-group backends, and how LoadBalancer Services map to passthrough load balancers.
29. Level 29: Application Load Balancer traffic management
    [Section 3: Configuring managed network services] Serves 3.1: you set up advanced traffic management on the Application Load Balancer. It covers weighted traffic splitting for canaries, traffic mirroring, and URL rewrites and redirects, all written in URL map route rules.
30. Level 30: Cloud CDN: origins, internet NEGs, invalidation
    [Section 3: Configuring managed network services] Serves 3.2: you turn on Cloud CDN for supported origins (managed instance groups, Cloud Storage buckets and Cloud Run). You also turn it on for external backends through internet NEGs, including third-party object storage, and practise cache modes, cache keys and invalidating cached content.
31. Level 31: Cloud DNS zones, records, migration and DNSSEC
    [Section 3: Configuring managed network services] Serves 3.3: you manage Cloud DNS public and private zones and record sets with gcloud, migrate an existing domain to Cloud DNS without downtime, and turn on DNS Security Extensions (DNSSEC) safely.
32. Level 32: Cloud DNS routing policies and split-horizon
    [Section 3: Configuring managed network services] Serves 3.3: you set up Cloud DNS routing policies (geolocation, weighted round robin and failover with health checks). You also build split-horizon DNS, where a private zone and a public zone serve different answers for the same name.
33. Level 33: Hybrid DNS: forwarding, policies, peering, GKE
    [Section 3: Configuring managed network services] Serves 3.3: you connect self-hosted DNS to Cloud DNS. That means forwarding zones, DNS server policies with inbound and outbound forwarding, DNS peering and DNS cross-project binding, plus Cloud DNS with the external-dns operator for GKE.
34. Level 34: Dedicated Interconnect and VLAN attachments
    [Section 4: Configuring and implementing hybrid and multicloud network interconnectivity] Serves 4.1: you go through creating a Dedicated Interconnect connection, from ordering and the LOA-CFA to cross-connect testing. You then set up VLAN attachments on a Cloud Router, and read the order of steps and the attachment's state.
35. Level 35: Partner and Cross-Cloud Interconnect
    [Section 4: Configuring and implementing hybrid and multicloud network interconnectivity] Serves 4.1: you create Partner Interconnect VLAN attachments with pairing keys. You learn the difference between layer 2 and layer 3 Partner Interconnect, and you create Cross-Cloud Interconnect connections and VLAN attachments to another cloud provider.
36. Level 36: Interconnect SLAs and HA VPN over Interconnect
    [Section 4: Configuring and implementing hybrid and multicloud network interconnectivity] Serves 4.1: you build Cloud Interconnect topologies that meet the 99.9% and 99.99% SLAs, spread across edge availability domains, metros, regions and Cloud Routers. You also set up HA VPN over Cloud Interconnect so traffic on the attachments is encrypted with IPsec.
37. Level 37: HA VPN to on-premises VPN gateways
    [Section 4: Configuring and implementing hybrid and multicloud network interconnectivity] Serves 4.2: you set up HA VPN toward on-premises VPN gateways. That includes external VPN gateway resources with one, two or four interfaces, IKEv2 tunnels, BGP sessions on Cloud Router, and the tunnel layouts that qualify for the 99.99% SLA.
38. Level 38: HA VPN between VPCs and Classic VPN
    [Section 4: Configuring and implementing hybrid and multicloud network interconnectivity] Serves 4.2: you set up HA VPN toward other Google Cloud VPCs, gateway to gateway. You also set up Classic VPN with route-based and policy-based tunnels, and learn when the exam expects Classic VPN rather than HA VPN.
39. Level 39: Cloud Router BGP attributes and BFD
    [Section 4: Configuring and implementing hybrid and multicloud network interconnectivity] Serves 4.3: you set up BGP attributes on Cloud Router: ASN (private and public), advertised route priority (MED), link-local BGP peering addresses and MD5 authentication. You also set up Bidirectional Forwarding Detection (BFD) for fast failover.
40. Level 40: Custom routes and BGP best path selection
    [Section 4: Configuring and implementing hybrid and multicloud network interconnectivity] Serves 4.3: you create custom advertised routes and custom learned routes on Cloud Router. You also choose between legacy and standard BGP best path selection for the VPC, and see how each mode treats MED, AS path and cross-region routes.
41. Level 41: NCC Hybrid Spokes and Site-to-Site Data Transfer
    [Configuring and implementing hybrid and multicloud network interconnectivity, 4.4] Learn to attach HA VPN tunnels and VLAN attachments to a Network Connectivity Center hub as hybrid spokes, and to turn on site-to-site data transfer so that on-premises sites and branch offices can reach each other over Google's network, with an honest look at when this is worth doing and the regional limits that apply.
42. Level 42: Router Appliances and Fixing Transitivity Problems
    [Configuring and implementing hybrid and multicloud network interconnectivity, 4.4] Learn to build router appliance (RA) spokes that peer third-party SD-WAN or NVA instances with Cloud Router over BGP, and to work through the common transitivity problems: VPC Network Peering is non-transitive, hybrid routes do not reach peered VPCs unless exported, and NCC is used to provide the transitivity peering lacks.
43. Level 43: Logging Cloud VPN, Cloud Router, Cloud NAT and Cloud DNS
    [Managing, monitoring, and troubleshooting network operations, 5.1] Learn to turn on and read Cloud Logging for the hybrid and service components (Cloud VPN, Cloud Router, Cloud NAT, Cloud DNS and Network Connectivity Center), including which logs are on by default and which have to be enabled.
44. Level 44: VPC Flow Logs, Firewall Logging and Firewall Insights
    [Managing, monitoring, and troubleshooting network operations, 5.1] Learn to enable and tune VPC Flow Logs (sampling, aggregation interval, metadata and filters), to turn on logging for Cloud NGFW and VPC firewall rules, to find VPC Service Controls violation logs, and to use Firewall Insights to find shadowed, overly permissive and unused rules, keeping log volume and cost in mind.
45. Level 45: Monitoring VPN, Interconnect and Cloud Router Metrics
    [Managing, monitoring, and troubleshooting network operations, 5.1] Learn which Cloud Monitoring metrics matter for hybrid links (Cloud VPN tunnel state and throughput, Cloud Interconnect and VLAN attachment capacity, utilization and errors, Cloud Router BGP session status and learned-route counts) and how to alert on them before users notice a problem.
46. Level 46: Monitoring Load Balancers, Cloud Armor and Cloud NAT
    [Managing, monitoring, and troubleshooting network operations, 5.1] Learn to monitor the service edge: load balancer request counts, latencies and backend errors, Google Cloud Armor allowed and denied request metrics, and Cloud NAT port allocation, dropped packets and endpoint-independent mapping behaviour.
47. Level 47: Network Intelligence Center: Topology, Performance, Analyzer
    [Managing, monitoring, and troubleshooting network operations, 5.2] Learn the Network Intelligence Center modules apart from Connectivity Tests (Network Topology, Performance Dashboard, Network Analyzer and Firewall Insights), and which one answers which troubleshooting question on the exam.
48. Level 48: Connectivity Tests for Reachability Debugging
    [Managing, monitoring, and troubleshooting network operations, 5.2] Learn to run Connectivity Tests from gcloud and the console to analyse configuration-based reachability and live data plane checks between VMs, load balancers, GKE, Cloud SQL, on-premises ranges and the internet, and to read the step-by-step trace that shows the blocking firewall rule or missing route.
49. Level 49: Draining and Redirecting Traffic on Application LB
    [Managing, monitoring, and troubleshooting network operations, 5.2] Learn to take backends out of service safely and move traffic with the Application Load Balancer, using connection draining timeouts, backend capacity scaling, weighted backend services and failover, so maintenance and incident response cause no user-visible errors.
50. Level 50: Troubleshooting VPN, BGP, Interconnect and NAT
    [Managing, monitoring, and troubleshooting network operations, 5.2] Learn a repeatable method for the outages the exam likes to test: IKE and IPsec negotiation failures and MTU problems on Cloud VPN, BGP sessions stuck or flapping on Cloud Router, VLAN attachments that will not come up on Cloud Interconnect, and Cloud NAT connection failures.
51. Level 51: Cloud NGFW Policies and VPC Firewall Rules
    [Configuring, implementing and managing a cloud network security solution, 6.2] Learn the Cloud Next Generation Firewall policy hierarchy (hierarchical firewall policies at organization and folder level, global and regional network firewall policies, and VPC firewall rules) and the exact order Google Cloud evaluates them in, including goto_next, implied rules and network policy enforcement order.
52. Level 52: Cloud NGFW Advanced: Tags, FQDN, Threat Intel, IPS
    [Configuring, implementing and managing a cloud network security solution, 6.2] Learn the Cloud NGFW Standard and Enterprise features: IAM-governed secure tags in place of network tags, FQDN, geolocation and threat intelligence objects, address groups, and the Enterprise intrusion prevention service with firewall endpoints, security profiles and TLS inspection.
53. Level 53: Google Cloud Armor Security Policies
    [Configuring, implementing and managing a cloud network security solution, 6.1] Learn to configure Google Cloud Armor backend and edge security policies with preconfigured WAF rules, custom rules language, IP and geo allow/deny lists, rate limiting and throttling, bot management, Adaptive Protection and preview mode, attached to load balancer backend services.
54. Level 54: Securing Egress: Public Cloud NAT and Secure Web Proxy
    [Configuring, implementing and managing a cloud network security solution, 6.3] Learn to control internet egress with Public Cloud NAT and Secure Web Proxy: policies, rules using host and URL matching, secure tags and service accounts, TLS inspection, and explicit versus next-hop routing modes. Then compare the two for allowlist-style egress requirements.
55. Level 55: Cloud IDS, Packet Mirroring and Third-Party Inspection
    [Configuring, implementing and managing a cloud network security solution, 6.4] Learn to configure self-managed and managed network packet inspection: Packet Mirroring policies to collectors behind an internal passthrough load balancer, Cloud IDS endpoints and threat severity, and the trade-offs between detection only and inline prevention.
56. Level 56: VPC Service Controls: Dry Run, Rules and Bridges
    [Configuring, implementing and managing a cloud network security solution] Building on the basic perimeters from Section 2.1, learn to run VPC Service Controls the way production needs: dry-run mode, ingress and egress rules, access levels, perimeter bridges, and private access from on-premises through restricted.googleapis.com, plus how to clear common denials safely.
57. Level 57: Exam Craft: Ops and Security Scenario Drill
    [Exam craft, Sections 5 and 6] Practise the multiple-choice and multiple-select 'best answer' questions that mix troubleshooting and security products, learning to spot keyword cues, rule out distractors that are technically possible but not best, and manage time across the whole guide.
58. Level 58: Timed Mock Exam Timed mock
    A timed 50-question, 120-minute mock exam of original scenario questions, weighted across all six exam guide sections, with every distractor explained and a 70% pass mark.

Access

The first 2 levels are free with a free account. Every level, the podcast edition and the AI tutor come with All Access at £4.99/month or any Creator plan — see pricing.

Start free →