The Google Cloud network is a globally distributed, software-defined infrastructure that connects computing resources across the planet. For the PCNE exam, you must understand how this network is designed and how traffic flows through it, because every networking question — from VPNs to load balancing — rests on this foundation. Without this understanding, you cannot diagnose why a connection fails or why a routing choice slows down a service.
Jump to a section
A simple way to picture Introduction to GCP Networking Concepts
A university campus is the physical ground of the network.
The campus has one main street (the internet) leading into it. Just outside the gate is a guard booth (a firewall) that checks every person arriving. Past the guard booth is a central plaza (the default network, called the VPC). From the plaza, separate paths lead to different buildings (subnets). One building is the library (a virtual machine, or VM), another is the gym (another VM), and a third is the admin office (a database). Each building has its own address (a private IP address), but the campus also gives each building a mailbox number (a public IP address) so the outside world can send letters there. The guard booth has a book (a routes table) that tells it how to deliver a letter to a building it doesn't recognise — it passes it to a special courier (a Cloud Router) that knows other campuses (on-premises networks). If a student wants to watch a live broadcast from the main hall, the guard booth can send a copy of the signal to every building at once (multicast). The guard booth can also be told to refuse entry to anyone from a certain delivery company (a firewall rule blocking a range of IP addresses). A campus-wide announcement system (Cloud DNS) turns the name "library" into the building's actual map coordinates. The campus is connected to a sister campus in another city via a private, secure tunnel (Cloud VPN), and the whole thing is managed from a central control room (the Google Cloud Console), where the campus security team can see every person moving through the grounds (VPC Flow Logs).
GCP's network architecture is built on a physical fibre-optic cable network that Google owns and operates. This is not like the public internet, where your data travels through cables owned by many different companies. Google's network is private, global, and carries data between all Google services and Google Cloud regions.
A region is a specific geographic location where Google runs its data centres. For example, us-central1 in Iowa or europe-west2 in London. Each region contains multiple zones, which are isolated physical data centres within that region. Zones are independent enough that a power failure in one zone should not affect another zone. When you create a virtual machine (VM), you choose a specific zone. A VM is a software simulation of a computer that runs on Google's physical servers. It has its own operating system and can run applications.
The fundamental networking building block in GCP is the Virtual Private Cloud (VPC). A VPC is a virtual version of a physical network that exists entirely in software. You define it with IP address ranges, subnets, and firewall rules. Every GCP project gets a default VPC automatically, but you can create custom VPCs with your own IP ranges.
Inside a VPC, you create subnets. A subnet is a subdivision of the VPC's IP address range. You assign each VM to a subnet, and that VM gets an internal IP address from that subnet's range. Subnets can be regional — they live in one region and span across all zones in that region. You cannot create a subnet that covers multiple regions. However, a VPC can have subnets in multiple regions.
Every VM in a VPC can communicate with every other VM in the same VPC using internal IP addresses, as long as no firewall rule blocks the traffic. This communication is fast, private, and free (no egress charges). Communication between VMs in different VPCs is not allowed by default. To connect VPCs, you use VPC peering, which creates a direct private connection between the two VPCs.
The VPC also controls how traffic leaves the VPC. A default route automatically sends all traffic whose destination is outside the VPC's IP range to the public internet. You can override this by creating custom routes. For example, you might send all traffic to an on-premises network through a VPN tunnel.
Firewall rules are applied at the VPC level, not on the individual VM. They control both incoming (ingress) and outgoing (egress) traffic. Each rule specifies a source IP range, a destination IP range, a protocol (like TCP or UDP), and a port (like port 80 for HTTP). Rules are stateful, meaning if you allow incoming traffic, the response traffic is automatically allowed.
Cloud DNS translates human-readable domain names (like www.example.com) into IP addresses. GCP provides a managed DNS service that you can use to publish your domain names.
Cloud Interconnect provides dedicated physical connections between your on-premises data centre and Google's network. This is for high-bandwidth, low-latency, and reliable connectivity. Cloud VPN creates an encrypted tunnel over the public internet to connect your on-premises network to your VPC.
The Global Load Balancer is a single anycast IP address that distributes traffic across multiple regions. Anycast means the same IP address is advertised from many locations around the world, and internet traffic is routed to the nearest location that advertises that IP. This provides low latency and high availability.
VPC Flow Logs capture metadata about the IP traffic flowing through your VPC. You can use these logs to diagnose connectivity issues, monitor network behaviour, and comply with security audits.
Shared VPC allows you to create a single VPC in a host project and share its subnets with other service projects. This is useful for organisations that want centralised network control.
Private Google Access allows VMs without public IP addresses to reach Google APIs and services. The traffic stays within Google's network, never traversing the public internet.
Create a custom VPC
In the Google Cloud Console, you define a new VPC network with a unique name and an IP address range in CIDR notation, such as 10.0.0.0/16. This VPC will be the virtual boundary for all your GCP resources in that project.
Add subnets in each region
For each region where you plan to deploy resources, you create a subnet within the VPC. Each subnet gets a smaller IP range, like 10.0.1.0/24 for us-central1. Subnets are regional, meaning a single subnet covers all zones inside that region.
Set up firewall rules
You create ingress and egress firewall rules to control traffic. For example, you create a rule that allows TCP traffic on port 443 from any source (0.0.0.0/0) to VMs tagged 'web-server'. Rules are applied to the VPC and matched against network tags or service accounts.
Deploy a VM and assign it to a subnet
You create a Compute Engine VM instance and choose the region, zone, and subnet. The VM automatically receives an internal IP address from the subnet's range. You can also assign a public IP address if needed for direct internet access.
Configure Cloud Router and a VPN tunnel
To connect the VPC to an on-premises network, you create a Cloud Router instance and define a Cloud VPN tunnel. The Cloud Router exchanges BGP routes with the on-premises router, so both sides can reach each other's IP ranges without manual route updates.
Enable Private Google Access on the subnet
In the subnet settings, you enable Private Google Access. This allows VMs with only internal IP addresses to reach Google APIs (like Cloud Storage, BigQuery) using Google's internal network, bypassing the public internet.
An IT professional managing the network for a mid-sized e-commerce company would use these concepts daily. Suppose the company has its own on-premises data centre running legacy applications, and it wants to move some microservices to Google Cloud.
First, the network engineer creates a custom VPC in the project. They choose an IP range, say 10.0.0.0/16. They then create two subnets: one in the us-central1 region (10.0.1.0/24) for web servers, and one in europe-west1 region (10.0.2.0/24) for database replicas. They deploy several VMs for the web tier in the us-central1 subnet and a managed database in the europe-west1 subnet.
To connect the on-premises data centre, the engineer sets up a Cloud VPN tunnel. They configure a Cloud Router to dynamically exchange routes using the BGP protocol — BGP (Border Gateway Protocol) is the routing protocol that tells the VPC and the on-premises router which IP ranges are reachable through the tunnel. The engineer also creates firewall rules: one rule allows HTTPS traffic (port 443) from the internet to the web VMs, and another rule allows database traffic (port 3306) from the web VMs to the database VMs.
The company's domain, shop.example.com, points to the Google Cloud Load Balancer. The load balancer distributes incoming customer requests to the web VMs across both zones in us-central1. If one zone fails, the load balancer automatically stops sending traffic there.
The company's security team wants to see all network traffic. The engineer enables VPC Flow Logs on the subnets and exports them to Cloud Logging, where security analysts can query them for suspicious activity.
When the company acquires a smaller competitor that also uses Google Cloud, the engineer creates a VPC peering connection between the two VPCs so that the competitor's database can be accessed by the company's web servers without traversing the public internet.
The engineer also sets up Private Google Access on the subnets, so that the VMs can access Google Cloud APIs (like Cloud Storage) without needing public IP addresses, which improves security and reduces costs.
The PCNE exam tests your understanding of the GCP network architecture primarily through scenario-based questions. You will not be asked to "define a VPC". Instead, you will be given a business requirement and must choose the correct networking service or configuration.
Key concepts the exam loves to test:
The difference between a zone, a region, and a multi-region. You must know that a VPC is a global resource, subnets are regional, and VMs are zonal. A common question: 'Can a VM in zone A communicate with a VM in zone B of the same region using its internal IP?' The correct answer is yes, because subnets are regional.
The difference between VPC peering and Shared VPC. VPC peering connects two separate VPCs but they remain administratively separate. Shared VPC allows one project (the host) to share subnets with other projects (service projects) while keeping centralised control. A trap question might describe a scenario where multiple teams need their own projects but all share the same network — that calls for Shared VPC, not peering.
Firewall rules are stateful and apply at the VPC level, not on the VM. A common trap: the question says "create a firewall rule on the VM" — that is wrong. Firewall rules are applied to network tags, service accounts, or VPC networks.
Cloud Interconnect versus Cloud VPN. Cloud Interconnect gives dedicated bandwidth and a Service Level Agreement (SLA), but can be expensive. Cloud VPN uses the public internet and is cheaper, but has no SLA and is subject to internet latency. The exam will test which one to use for specific latency or bandwidth requirements.
Private Google Access is required for VMs without public IPs to reach Google APIs. If a question describes a VM with only an internal IP that cannot call a Storage API, the answer is to enable Private Google Access on the subnet.
The Global Load Balancer uses anycast IPs. The exam may present a scenario where users in different regions need to reach the same application with low latency — the correct answer is the Global Load Balancer, not a regional load balancer.
BGP is used with Cloud Router for dynamic routing over VPN or Interconnect. You must know that static routes are also possible, but BGP is preferred for automatic failover.
VPC Flow Logs do not capture packet payloads — only metadata (source IP, destination IP, port, protocol, packet count). The exam may try to trick you into thinking Flow Logs capture the actual data being sent.
Default routes allow outbound internet access to VMs with public IPs. The exam might ask: 'What happens if you delete the default route?' The answer is that VMs lose outbound internet access unless you create a custom route to a NAT gateway or VPN.
A VPC is a global resource that can span multiple regions, while subnets are regional and each subnet covers all zones in its region.
Firewall rules in GCP are stateful, applied at the VPC network level, and evaluate traffic based on network tags and service accounts, not on individual VMs.
Cloud Interconnect provides dedicated, low-latency, high-bandwidth connections with an SLA, while Cloud VPN offers encrypted tunnels over the public internet with no bandwidth guarantee.
Private Google Access enables VMs with only internal IP addresses to reach Google APIs and services without traversing the public internet.
VPC peering connects two separate VPCs directly, but they remain administratively independent, whereas Shared VPC enables centralised network control across multiple projects.
The Global Load Balancer uses a single anycast IP address to distribute traffic across regions, automatically routing users to the nearest healthy backend.
BGP (Border Gateway Protocol) is used with Cloud Router for dynamic route exchange over VPN and Interconnect, enabling automatic failover and route discovery.
VPC Flow Logs capture only IP traffic metadata (source, destination, protocol, ports, packet count), not the actual payload of the network packets.
These come up on the exam all the time. Here's how to tell them apart.
VPC Peering
Connects two separate VPCs directly using internal IPs.
Each VPC remains administratively independent with its own firewall rules and IAM policies.
Best used when different teams or organisations need to communicate but manage their own networks.
Shared VPC
Allows one host project to share its VPC subnets with multiple service projects.
Centralised network administration in the host project controls all subnets and firewall rules.
Best used when a central networking team manages the whole network and other teams deploy resources into shared subnets.
Cloud Interconnect
Provides dedicated physical connections between on-premises and Google's network.
Offers a Service Level Agreement (SLA) for availability and bandwidth.
Higher cost and longer setup time due to physical infrastructure.
Cloud VPN
Creates an encrypted tunnel over the public internet.
No SLA for bandwidth or availability; subject to internet congestion.
Lower cost and faster setup; suitable for smaller or less critical connections.
Global Load Balancer
Uses a single anycast IP address to distribute traffic across multiple regions.
Automatically routes users to the nearest region with available capacity.
Best for global applications that need low latency worldwide.
Regional Load Balancer
Distributes traffic within a single region only.
Uses a regional IP address and does not automatically reroute to other regions.
Best for applications that only serve users in one geographic area.
Cloud Router with BGP
Dynamically exchanges routes with on-premises routers using BGP.
Automatically learns about new subnets and handles failover if a tunnel goes down.
More complex to set up but provides resilience and flexibility.
Static Routes
Manually configured routes that define fixed paths to destinations.
Does not adapt to changes; requires manual updates when the network changes.
Simpler to set up for simple, stable environments with one or two routes.
Mistake
A VPC is a regional resource, so you must create a separate VPC for each region.
Correct
A VPC is a global resource that spans all regions. Subnets are regional, but the VPC itself is not.
This mistake comes from other cloud providers like AWS, where VPCs are regional. Google Cloud is different, and beginners often carry over the AWS model.
Mistake
Firewall rules need to be applied individually to each VM to be effective.
Correct
Firewall rules are applied at the VPC network level using network tags or service accounts. They are not applied directly to VMs.
People think of VM-level firewalls from on-premises environments. GCP's centralised firewall model is different and easier to manage.
Mistake
Cloud VPN provides a dedicated, private connection with a bandwidth guarantee.
Correct
Cloud VPN tunnels traverse the public internet. They are encrypted but offer no dedicated bandwidth or SLA. Cloud Interconnect provides dedicated bandwidth.
The term 'private' in VPN often misleads people into thinking the data path is private. Google uses 'private' to mean encrypted, not isolated.
Mistake
You can create a subnet that spans multiple regions.
Correct
Subnets are regional. A single subnet covers all zones within a single region, but cannot extend to another region.
The idea of a large, flexible subnet across regions sounds efficient, but it would violate the network design principles of fault isolation and low latency.
Mistake
VM-to-VM communication across different VPCs is automatic if both VPCs are in the same project.
Correct
VM-to-VM communication is only automatic within the same VPC. To communicate across different VPCs, you must set up VPC peering or use Shared VPC.
The term 'project' makes beginners think all resources in a project can talk to each other. VPCs provide network isolation even within the same project.
Mistake
Deleting a default route stops all traffic from leaving the VPC.
Correct
Deleting the default route stops traffic to destinations not defined by other routes. Traffic to destinations with a more specific custom route will still work.
The word 'default' makes people think it is the only way out. But custom routes can override it for specific destinations.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
A VPC (Virtual Private Cloud) is the overall virtual network that spans all regions. A subnet is a smaller, regional subdivision of that VPC's IP address range. VMs get their internal IP addresses from a subnet.
Yes, because subnets in GCP are regional. A subnet covers all zones in a region, so VMs in different zones of the same region can communicate using their private internal IPs with low latency.
Not necessarily. You can use Cloud NAT to allow VMs without public IPs to access the internet. But for direct inbound access from the internet, the VM needs a public IP or a load balancer in front of it.
VPC peering connects two separate VPCs so they can communicate using internal IPs, but each VPC stays administratively independent. Shared VPC allows a central host project to share subnets with other service projects, giving central control.
No. Subnets are regional. You can create a separate subnet in each region, but a single subnet cannot extend beyond its region. The VPC spans all regions, but each subnet is confined to one region.
Private Google Access allows VMs with only internal IPs to reach Google APIs and services without going through the public internet. Use it for security and to reduce data transfer costs.
You've finished Introduction to GCP Networking Concepts. Continue through the PCNE study guide to build a complete picture of the exam.
Done with this chapter?