Pro Network Engineer Cert Flashcards
What are the three types of networks?
Default , auto, and custom
What is the default network?
It is an auto-mode network with one subnet per region, fixed /20 per region, expandable to /16. Comes with default firewall rules.
What is an auto-mode network?
One subnet per region, fixed /20 per region, expandable to /16. Regional IP allocation.
What is a custom network?
No default subnets created, full control of IP ranges, regional IP allocation, expandable to any RFC 1918 size
Are subnets zonal or regional or global?
They are regional - one subnet can span multiple zones
What is the first available address in a subnet? What are the ones before it for?
.0 is for the network, .1 is for the gateway, so .2 is the first available
Does a VM know its external address?
No
Are public DNS records published automatically?
Nope
What is the SLA for Cloud DNS?
100%
How do you assign multiple IP addresses to a VM? Why would you do this?
Can assign multiple through multiple NICs. You can use this to bridge multiple networks or have management network.
How do you assign a range of IP addresses to a VM? Why would you do this?
Can assign a range through alias IPs. Can assign range for giving services (i.e. containers) their own IP addresses.
What is default routing?
Every network has a default route to get out of the network. Routes default to get to the other subnets as well.
Where are firewall rules applied?
At the instance level
Are firewall rules stateful?
Yes
What are the default firewall rules?
DENY ALL ingress and ALLOW ALL egress
How many NICs can a VM have?
At least 2. After 2, it’s the number of CPUs until 8. Max is 8.
When can you add, change, or delete multiple NICs?
Only at instance creation
Which NIC does internal DNS associate to?
nic0
What are the restrictions for IPs/networks for multiple NICs
Each NIC is on a different network, IP ranges cannot overlap at all, networks must already exist before being configured
What are the basic roles for networking? What can they do?
Network viewer - read-only access to all networking
Network admin - permissions to create/modify/delete except for firewall rules and SSL certs
Security admin - can create/modify/delete SSL certs and firewall rules
What can you specify for targets with firewall rules?
All instances, specified target tags, specified service accounts
What can you specify for sources with firewall rules?
IP ranges, subnets, source tags, and service accounts
What three roles are needed to provision and manage a shared VPC?
Org admin -> Shared VPC Admin -> Service Project Admin
Is transitive peering supported?
Nope
What is the advantage of shared VPC over VPC network peering?
Centralized network admin, simplifies internal DNS
What is the advantage of VPC network peering over shared VPC?
Can be used across orgs, multiple projects, or within a single project. Decentralized network admin if you like that. Quotas aren’t used as quickly if you can use multiple projects.
Can you peer with a shared VPC?
Yes
How are DNS names handled across VPC peering?
DNS names are NOT transferred across with VPC peering
What policies are available for autoscaling a managed instance group?
CPU utilization, load balancing capacity, monitoring metrics, and queue-based workloads
What are the global load balancing services?
HTTP(s) Load Balancer, TCP Proxy, and SSL Proxy
What are the regional load balancing services?
Network TCP/UDP load balancer, internal load TCP/UDP load balancing
Where is IPv6 supported?
HTTP(s) Load Balancer, TCP Proxy, and SSL Proxy
What are the key features of a global HTTP(s) load balancer?
Global load balancing, anycast IP, does auto-scaling, can have backend services with health chekcs, session affinity (with timeouts), and one-or-more backends
What three things does a backend need to be configured?
An instance group, a balancing mode (CPU or RPS), and a capacity scaler (ceiling % of CPU/rate targets)
What is cloud armor?
Protects load balancers from DDOS, can blacklist or whitelist IPs, can configure the deny rule, can set priority to rules
What are the key features of an SSL proxy?
Global load balancing for encrypted, non-HTTP traffic, terminates SSL, can do intelligent routing and certificate management, auto security patching
What are the key features of a TCP proxy?
Global load balancing for non-encrypted, non-HTTP traffic, terminates TCP connections, intelligent routing and security patching
What are the key features of a network load balancer?
Regional load balancing for TCP/UDP (non-proxied), forwarding rules, has instance groups and target pools
What are the key features of an ILB
Similar to NLB but internal, has fully distributed software defined load balancing
How do L2 connections connect to GCP?
They connect a VLAN to a specific GCP network
What routing does a VPN support?
Static routing or dynamic routes via BGP with a cloud router
What is the VPN gateway?
A regional resource that uses external IP address
Are any other IPs needed for a VPN setup?
Need to add separate link-local IP address to establish BGP for dynamic routing
What are the SLAs for dedicated interconnect?
99.9% for single connection, 99.99% for double in different regions
What is direct peering?
Direct connection to Google for access to Google services (non-customer GCP)
What do you do if you cannot meet the peering requirements?
Partner peering
What is the SLA for peering?
None
When are you charged for networking?
Egress to anything out of the zone/region but within-region and global Google products
What sacrifices are made for the standard network tier?
No global load balancing, no global SLA, more network hops because it doesn’t use GCPs backbone
What is private Google access?
VMs with only private IPs can still access Google services (like storage buckets), granted at the subnet level
What is the benefit of cloud NAT over traditional NAT?
It has 1 fewer hop because it’s software defined at the instance level
What is manual mode vs auto mode for the NAT?
Manually specify IPs for full control or automatically do it with auto-scaling
How do you prevent deployment manager from deploying sequential things in parallel?
Add a reference to the previous step in the next step
What are VPC Flow Logs?
A sample of logs flowing to/from VMs on the network, sampled every 5 seconds with no latency hit, enabled at the subnet
What is included in the VPC flow log?
IPs/ports/protocol, plus start/end times, bytes, instance details, vpc details, geography
