Question 1

What is a VPC in GCP and how is it different from an AWS VPC?

Accepted Answer

A GCP VPC is a global, software-defined private network. It spans every region automatically, and subnets are regional resources inside it, so instances in Mumbai and Frankfurt can sit in the same VPC and reach each other over private IPs with no peering or gateway. An AWS VPC is regional, so a multi-region deployment needs several VPCs plus peering or a transit gateway. This is the single most distinctive fact about GCP networking and interviewers ask it constantly. The follow-up consequence: routes and firewall rules are VPC-wide, so a firewall rule you write once applies across every region, which is powerful and also means a mistake has global blast radius.

Question 2

What is a subnet in GCP and what does it determine?

Accepted Answer

A subnet is a regional IP range within a VPC. It determines which region resources live in and which internal IPs they receive. Subnets can be expanded in place without downtime, and a VPC-native GKE cluster additionally uses secondary ranges on the subnet for pod and service IPs. Two facts to include: subnets cannot span regions, and you can grow a subnet's primary range but never shrink it, and never in a way that overlaps another subnet in the same VPC or in a peered VPC. That "can grow, cannot shrink, must not overlap" trio is what drives IP address planning.

Question 3

What is the difference between auto mode and custom mode VPC?

Accepted Answer

An auto-mode VPC automatically creates one subnet in every region from a predetermined 10.128.0.0/9 block, and creates new subnets when Google adds regions. A custom-mode VPC creates no subnets — you define each one explicitly with the CIDR range you choose. Production networks should always be custom mode. The reason is IP planning: auto mode's fixed ranges will eventually overlap with an on-premises network or a partner's VPC, and overlapping ranges make peering and VPN impossible to fix without renumbering. Auto mode is a convenience for demos; recommending it for production is a red flag.

Question 4

How do GCP firewall rules work?

Accepted Answer

Firewall rules are stateful and VPC-wide. Each rule has a direction (ingress or egress), a priority from 0 to 65535 where lower wins, an action (allow or deny), a source or destination specification, and a target — all instances, instances with a network tag, or instances using a specific service account. Because they are stateful, allowing an inbound connection automatically allows the return traffic. The implied rules are what interviewers check: every VPC has an implied allow-all-egress and an implied deny-all-ingress at priority 65535, and these cannot be deleted, only overridden by higher-priority rules. Knowing that targeting by service account is generally safer than by network tag — because anyone who can edit an instance can add a tag, whereas changing the service account requires more permission — is a strong differentiator.

Question 5

Which source ranges must you allow for Google Cloud health checks?

Accepted Answer

130.211.0.0/22 and 35.191.0.0/16 for most load balancers and managed instance group health checks. If these are not allowed to reach your backends, the health checks fail, the load balancer marks every backend unhealthy, and traffic is dropped even though the application is fine. This is one of the highest-value pieces of trivia in GCP networking because it is the cause of a very common "load balancer returns 502 but the app works when I curl it locally" incident. Being able to recite the ranges signals hands-on experience immediately.

Question 6

What is Cloud NAT and when do you need it?

Accepted Answer

Cloud NAT is a managed, distributed network address translation service that gives instances without external IP addresses outbound access to the internet, while accepting no unsolicited inbound connections. You need it for private VMs and private GKE nodes to reach package repositories, third-party APIs or public container registries. The key properties to name: it is software-defined with no NAT gateway instances to manage or scale, it is configured per region on a Cloud Router, and port exhaustion is a real failure mode — each VM gets a fixed allocation of ports per NAT IP, so a VM opening thousands of concurrent outbound connections will fail with dropped connections unless you increase minimum ports per VM or add NAT IPs.

Question 7

What is Private Google Access?

Accepted Answer

Private Google Access is a per-subnet setting that lets instances without external IPs reach Google APIs and services — Cloud Storage, BigQuery, Artifact Registry — using their external IP addresses, but with the traffic staying on Google's network rather than traversing the internet. It requires a route to the default internet gateway even though no external IP is used. The distinction from Cloud NAT is what gets tested: Private Google Access covers *Google* APIs only, Cloud NAT covers the general internet. Many private designs need both — Private Google Access for GCP services, Cloud NAT for third-party endpoints — and knowing they are complementary rather than alternatives is the point.

Question 8

What is Private Service Connect?

Accepted Answer

Private Service Connect lets you consume Google APIs or a service published by another VPC through a private IP endpoint inside your own VPC. Instead of reaching a Google API at its public IP, you create an endpoint with an internal address in your subnet, which keeps traffic private, avoids IP range conflicts and works cleanly across organisations. The advantage over VPC peering is the key point: peering requires non-overlapping CIDR ranges and exposes the whole network, whereas Private Service Connect exposes exactly one service through one address and has no transitivity problem. It is how modern managed services and SaaS partners publish into customer VPCs.

Question 9

What is VPC Network Peering and what are its limitations?

Accepted Answer

VPC peering connects two VPCs so their internal IPs can communicate directly over Google's network, without a VPN or external IPs. The limitations are that IP ranges must not overlap, peering is not transitive — if A peers with B and B peers with C, A cannot reach C — and each VPC has a limit on the number of peerings and on the aggregate routes learned. Non-transitivity is what forces architectural decisions: a hub-and-spoke topology needs either a Network Connectivity Center hub, a router appliance, or Shared VPC instead of peering. Candidates who do not know peering is non-transitive design topologies that simply cannot work.

Question 10

What is Shared VPC?

Accepted Answer

Shared VPC lets one host project own the network — subnets, firewall rules, routes — while other service projects attach to it and create resources such as VMs and GKE clusters using those subnets. It centralises network administration and IP management in a network team while letting application teams own their own projects, quotas and billing. The IAM detail interviewers probe: a service project user needs the Network User role on the specific subnet, not on the whole host project, which is how you keep teams inside their assigned ranges. Shared VPC is the default enterprise pattern precisely because it separates network governance from application ownership.

Question 11

When would you choose Shared VPC over VPC peering?

Accepted Answer

Shared VPC when the projects belong to one organisation and you want a single team to govern the network and IP space centrally — it avoids the peering route limits and the non-transitivity problem entirely. Peering when the VPCs are independently administered, possibly in different organisations, and each side wants to keep control of its own network. The tie-breaker to state is administrative boundary, not technology. Shared VPC implies one network authority; peering implies two negotiating parties. Choosing peering inside one organisation usually creates avoidable topology pain.

Question 12

What types of routes exist in a GCP VPC?

Accepted Answer

System-generated subnet routes for each subnet range, which cannot be deleted; a default route to the internet gateway, which can be deleted to force a fully private network; custom static routes you create, typically pointing at a VM appliance or a VPN tunnel; and dynamic routes learned by a Cloud Router over BGP from Cloud VPN or Interconnect. The security lever worth naming is deleting the default internet route to guarantee no accidental internet egress, then reintroducing controlled egress through Cloud NAT or a proxy. Route priority and the fact that the most specific prefix wins before priority is the other detail interviewers use to separate levels.

Question 13

What is a Cloud Router?

Accepted Answer

Cloud Router is a managed BGP speaker that exchanges routes dynamically between your VPC and an external network over Cloud VPN or Cloud Interconnect. It advertises your VPC subnets to the peer and installs the peer's advertised routes into the VPC, so topology changes propagate without manual static route edits. It is also the control plane for Cloud NAT. The two behaviours to know are custom route advertisement, letting you advertise specific ranges rather than everything, and dynamic routing mode: regional mode only advertises and learns routes for the router's own region, while global mode covers the whole VPC. Choosing regional by accident is a classic cause of "the Mumbai subnet cannot reach on-premises".

Question 14

What options exist for connecting on-premises networks to GCP?

Accepted Answer

Cloud VPN (HA VPN) creates IPsec tunnels over the internet with a 99.99% SLA when configured with two interfaces — cheap and quick but limited by internet quality and per-tunnel throughput. Dedicated Interconnect provides a direct physical connection at 10 or 100 Gbps into a Google colocation facility. Partner Interconnect provides connectivity through a service-provider partner at lower bandwidth increments. Cross-Cloud Interconnect connects GCP directly to another cloud. The decision framing is bandwidth, latency predictability and cost. Interviewers often ask how you would achieve a 99.99% SLA on HA VPN — the answer is two interfaces with two tunnels to two peer devices, because a single-interface configuration only carries a 99.9% SLA.

Question 15

What is the difference between an internal and an external IP address in GCP, and what is an alias IP?

Accepted Answer

An internal IP is a private RFC 1918 address from the subnet range, used for communication inside the VPC. An external IP is a public address, either ephemeral or reserved static, used for internet reachability. An alias IP range is an additional range assigned to a VM's interface so that containers or services on that VM can each have their own routable IP — this is the mechanism behind VPC-native GKE. Alias IPs are the answer to "how do pods get real VPC addresses in GKE?" — that connection between a networking primitive and the GKE behaviour is exactly what a strong candidate makes explicit.

Question 16

What are the GCP load balancer types and how do you choose?

Accepted Answer

Global external Application Load Balancer for HTTP(S) traffic worldwide, with a single anycast IP, Cloud CDN, Cloud Armor and content-based routing. Regional external Application Load Balancer when you need the traffic to stay in one region for compliance. External passthrough Network Load Balancer for TCP/UDP at regional scope, preserving the client IP. Internal Application and internal passthrough Network Load Balancers for traffic inside the VPC. The distinguishing property to name is proxy versus passthrough: an Application Load Balancer terminates the connection and can inspect and route on HTTP attributes, whereas a passthrough NLB forwards packets without terminating, preserving source IP and supporting arbitrary protocols. Choosing between them is really choosing whether you need L7 features.

Question 17

How does the global external Application Load Balancer achieve a single global IP?

Accepted Answer

It uses anycast: the same IP address is announced from Google points of presence worldwide, so a user's traffic enters at the nearest edge. From there it travels Google's private backbone to the closest healthy backend with capacity. There is no DNS-based region selection and no per-region IP to manage. The comparison that lands is with DNS-based global routing, which suffers from client-side caching and slow failover. Anycast failover is near-instant because it happens in the network layer rather than waiting for a TTL to expire.

Question 18

What is a backend service and what does it configure?

Accepted Answer

A backend service defines how a load balancer distributes traffic: which backends (instance groups or network endpoint groups) receive it, the health check, the balancing mode (by rate, utilisation or connection), capacity scaler, session affinity, timeout, Cloud CDN settings and the Cloud Armor policy attached. The balancing mode is the substantive part. RATE mode with a max requests per second per instance is what allows the load balancer to spill over to another region when a region is at capacity — which is how a global load balancer actually achieves global failover, and it only works if you configured capacity correctly.

Question 19

What is a network endpoint group (NEG)?

Accepted Answer

A NEG is a group of backend endpoints identified individually rather than as whole VMs. Zonal NEGs hold IP-and-port pairs used for container-native load balancing to GKE pods; serverless NEGs point at Cloud Run, Cloud Functions or App Engine services; internet NEGs point at an external endpoint; and hybrid NEGs point at on-premises endpoints. Serverless NEGs are the mechanism that lets you put a global load balancer with Cloud CDN and Cloud Armor in front of Cloud Run — that is the practical reason most engineers first encounter them, and connecting the concept to that use case is what makes the answer concrete.

Question 20

What is Cloud DNS and what is a private zone?

Accepted Answer

Cloud DNS is Google's managed, globally distributed authoritative DNS service with a 100% availability SLA. A public zone serves records to the internet; a private zone serves records only to specified VPC networks, so you can resolve internal hostnames such as db.internal to private IPs without exposing them publicly. The features to name for a hybrid setup are DNS forwarding zones, which send queries for an on-premises domain to your own DNS servers, and DNS peering, which lets one VPC use another VPC's private zones. Those two are what make Cloud DNS work in an enterprise rather than a single-project setup.

Question 21

What are VPC Flow Logs and what would you use them for?

Accepted Answer

VPC Flow Logs record a sample of network flows to and from VM interfaces, including source and destination, ports, bytes, packets and whether the flow was allowed. They are used for network monitoring, forensics and incident investigation, cost analysis of egress, and to verify that firewall rules behave as intended. The practical caveats: they are sampled, not complete, and the volume and therefore the logging cost can be very large, so you enable them per subnet with an aggregation interval and sampling rate tuned to need. Exporting to BigQuery for analysis is the standard pattern.

Question 22

What is Firewall Insights?

Accepted Answer

Firewall Insights analyses firewall rule usage over time and reports shadowed rules that can never match because a higher-priority rule covers them, rules with no hits at all, and rules that are overly permissive relative to observed traffic. It is the tool for safely cleaning up an accumulated firewall ruleset. The value is that deleting an unused rule is normally terrifying because nobody remembers why it exists. Hit-count data over 30 or more days turns that into an evidence-based decision, which is exactly the kind of answer a security-focused interviewer wants.

Question 23

What are hierarchical firewall policies?

Accepted Answer

Hierarchical firewall policies are firewall rules applied at the organisation or folder level that are evaluated *before* VPC-level rules and are inherited by all projects underneath. They let a central security team enforce non-negotiable rules — such as denying inbound RDP from the internet everywhere — that a project owner cannot override. The evaluation order is the substance: hierarchical policies first, then VPC firewall rules, with goto_next as the action that delegates the decision downwards. This is how you separate mandatory organisational controls from team-level flexibility.

Question 24

How would you design a VPC for a company with dev, staging and production?

Accepted Answer

A Shared VPC host project per environment, or one host project with clearly separated subnets and hierarchical firewall policies, with service projects per application team. Non-overlapping, well-documented CIDR blocks reserved per environment and per region with room to grow; no default internet route, with egress through Cloud NAT; Private Google Access on every subnet; hierarchical deny rules at the folder level; and VPC Service Controls perimeters around production data services. The critical, irreversible decision is the IP plan — get the CIDR allocation wrong and you cannot peer with on-premises or acquire a company without renumbering. Leading with IP planning rather than with firewall rules is what marks this as a senior answer.

Question 25

What is the difference between egress and ingress firewall rules, and what is the default for each?

Accepted Answer

Ingress rules control traffic arriving at an instance; egress rules control traffic leaving it. The implied defaults are deny all ingress and allow all egress, both at priority 65535. Most hardening work involves adding explicit egress deny rules, because the permissive egress default is what allows a compromised instance to exfiltrate data or call out to a command-and-control server. Recommending egress restriction unprompted is a strong security signal. The practical approach to describe is a default-deny egress rule at a low priority with explicit allows for required destinations, combined with Private Google Access so GCP API calls still work.

Question 26

Two instances in the same VPC cannot reach each other. How do you troubleshoot?

Accepted Answer

Check that both are in the same VPC and that their subnets are in the expected regions; confirm a firewall rule allows the traffic in the right direction with matching target tags or service accounts; verify the guest OS firewall (iptables, firewalld or Windows Firewall) is not blocking it; then use Network Intelligence Center Connectivity Tests to trace the exact path and see which rule or route is responsible. Naming Connectivity Tests specifically is the strongest move — it simulates the packet path and names the blocking rule, turning guesswork into a definitive answer in one step. The guest OS firewall is the second half people forget, because GCP rules can be perfect while the OS drops the packet.

Question 27

What is Network Intelligence Center?

Accepted Answer

Network Intelligence Center is a suite of network observability tools: Network Topology for a visual map of traffic, Connectivity Tests for path analysis between endpoints, Performance Dashboard for packet loss and latency between zones, Firewall Insights for rule usage, and Network Analyzer for automatic detection of misconfigurations such as IP exhaustion or shadowed rules. Network Analyzer is the one worth calling out because it proactively surfaces problems — subnets nearing IP exhaustion, GKE clusters that cannot scale further because of pod range limits — before they cause an incident. That predictive angle is what makes it interesting in an interview.

Question 28

What is a VPC Service Controls perimeter and how does it differ from a firewall?

Accepted Answer

A firewall controls network packets between IP addresses. A VPC Service Controls perimeter controls access to *Google managed services* at the API level — it prevents data in BigQuery, Cloud Storage or Bigtable from being read out of the perimeter even by an identity holding valid IAM permissions, because those services are reached over the internet-facing API rather than through your VPC. The gap it closes is exfiltration through legitimate credentials: firewalls cannot help when the attacker uses stolen credentials from anywhere in the world to call storage.googleapis.com. Access levels, ingress and egress rules and dry-run mode are the follow-ups for a security-role interview.

Question 29

How does GCP handle DDoS protection?

Accepted Answer

Google's global load balancers absorb and dissipate volumetric layer 3 and 4 attacks automatically at the edge, because traffic hits Google's infrastructure before reaching your project. Cloud Armor adds layer 7 protection with rate limiting, WAF rules, adaptive protection using machine learning to detect anomalous patterns, and geo-based blocking. Cloud Armor Managed Protection Plus adds attack response support and bill protection. The architectural point is that DDoS protection depends on being behind a global load balancer — a VM with a public IP receives attack traffic directly and has no such shield. That is why "no public IPs on instances, everything behind the load balancer" is a security recommendation and not just tidiness.

Question 30

What is Cloud CDN and how does cache invalidation work?

Accepted Answer

Cloud CDN caches content at Google's edge locations, served from the same global load balancer, using origin Cache-Control headers, negative caching for error responses, and optional cache modes such as caching all static content regardless of origin headers. Invalidation is performed per URL or path pattern and is best used sparingly. The best-practice answer is to avoid invalidation entirely by using versioned or content-hashed URLs, so a new deploy fetches a new path and old cached objects simply age out. Frequent invalidation is a design smell and is also rate-limited, which is the practical reason not to depend on it.

Question 31

What is the difference between the Premium and Standard network tiers in practice?

Accepted Answer

Premium Tier carries traffic on Google's private backbone from the edge closest to the user all the way to the region, supports global load balancing and global anycast IPs, and delivers lower and more consistent latency. Standard Tier keeps traffic on the public internet until it reaches the region, costs meaningfully less for egress, and only supports regional load balancing. The cost-conscious answer is to mix them: Standard for bulk egress such as backups and log shipping, Premium for user-facing traffic. Knowing that the tier can be selected per resource, not just per project, is what makes that mixing possible.

Question 32

What is Network Connectivity Center?

Accepted Answer

Network Connectivity Center provides a hub-and-spoke model where a hub connects spokes — VPCs, VPN tunnels, Interconnect attachments and router appliances — enabling transitive connectivity that plain VPC peering cannot provide. It is how you build a many-site or many-VPC topology without a full mesh. It directly answers the non-transitivity limitation of peering, so mentioning it right after explaining that limitation shows you know the whole picture rather than just the constraint.

Question 33

How do you restrict which external IPs a project may use, or forbid them entirely?

Accepted Answer

Apply the organisation policy constraint constraints/compute.vmExternalIpAccess, which by default can deny external IPs on all VMs and be relaxed with an allow list of specific instances. This is enforced regardless of the IAM permissions of whoever creates the VM. The point of this question is the IAM-versus-org-policy distinction: a project owner has permission to attach an external IP, and only an org policy can actually stop them. Answering with "review IAM" instead of naming the constraint is the weaker answer.

Question 34

What is IPv6 support like on GCP?

Accepted Answer

GCP supports dual-stack subnets with both internal and external IPv6 ranges, and IPv6 termination on global external Application Load Balancers even when the backends are IPv4-only, so you can offer IPv6 to clients without changing your application. Full IPv6-only VPC support is more limited than IPv4. The pragmatic pattern to name is IPv6 at the load balancer with IPv4 behind it, which satisfies client-side IPv6 requirements with almost no internal change. That is what most organisations actually do, and knowing it is more useful than reciting range formats.

Question 35

How is network egress charged and how do you reduce it?

Accepted Answer

Traffic within a zone using internal IPs is free; traffic between zones in a region and between regions is charged at increasing rates; egress to the internet is charged by destination continent and volume; and ingress is free. Reduce it by co-locating compute with data, caching at the edge with Cloud CDN, compressing responses, using Standard Tier for non-user-facing bulk transfer, and keeping cross-region chatter to a minimum. The cost surprise interviewers probe is cross-region traffic inside your own architecture — a service in one region querying a database in another can quietly generate a large egress bill. Naming that internal pattern rather than only internet egress is what makes the answer complete.

Question 36

What is a forwarding rule?

Accepted Answer

A forwarding rule binds an IP address, protocol and port range to a target — a target HTTP proxy, target pool or backend service — and is the object that actually receives traffic for a load balancer. Global forwarding rules serve global load balancers with an anycast IP; regional forwarding rules serve regional and internal load balancers. It is worth being able to lay out the full chain for an Application Load Balancer: forwarding rule → target proxy → URL map → backend service → backend (instance group or NEG) → health check. Being able to recite that chain is a reliable indicator that someone has actually built one.

Question 37

What is a URL map in a GCP load balancer?

Accepted Answer

A URL map defines host and path based routing rules for an Application Load Balancer — sending /api to one backend service, /static to a backend bucket, and a different hostname to a different service entirely. It also supports header-based routing, rewrites, redirects and traffic splitting by weight. Traffic splitting in the URL map is the feature to highlight, because it lets you canary at the load balancer without a service mesh or duplicated infrastructure. That capability plus header-based routing covers most progressive-delivery requirements.

Question 38

A GKE cluster cannot scale beyond a certain node count. What is the likely networking cause?

Accepted Answer

IP exhaustion in the VPC-native cluster's secondary ranges. Each node is allocated a pod CIDR block — a /24 by default — from the pod secondary range, so the maximum node count equals the number of such blocks in that range. If the range was sized too small at cluster creation, the Cluster Autoscaler simply stops adding nodes. The mitigation is to reduce the maximum pods per node, which shrinks the per-node block and multiplies capacity, or to add a new subnet range with discontiguous multi-Pod CIDR. The reason interviewers like this question is that it is a real, non-obvious limit that only bites in production at scale.

Question 39

What is Packet Mirroring?

Accepted Answer

Packet Mirroring clones traffic from selected instances and sends full packet copies to a collector — typically an internal load balancer in front of an intrusion-detection or network-forensics appliance. Unlike flow logs it captures payloads, not just metadata, and it is not sampled. The trade-offs to name are bandwidth consumption, which counts against the mirrored instances' network capacity, and the privacy implications of capturing payloads, which usually requires an explicit policy decision. It is a security-team tool, not a general debugging one.

Question 40

Design a secure, highly available network for a regulated financial application on GCP.

Accepted Answer

Custom-mode Shared VPC with a documented non-overlapping IP plan; no external IPs on any workload, enforced by org policy; egress via Cloud NAT with an explicit default-deny egress firewall baseline; Private Google Access and Private Service Connect for GCP APIs; hierarchical firewall policies for mandatory organisational rules; VPC Service Controls perimeters around data services with dry-run first; HA VPN with two interfaces or Dedicated Interconnect for on-premises with Cloud Router BGP; global Application Load Balancer with Cloud Armor and managed certificates as the only ingress; VPC Flow Logs and Packet Mirroring to a security collector; and Cloud DNS private zones with forwarding to on-premises resolvers. The closing scenario. The markers of seniority are enforcing controls with org policy rather than convention, running VPC Service Controls in dry-run before enforcement, and specifying the two-interface HA VPN configuration explicitly because that is what carries the 99.99% SLA.

GCP VPC & Networking Interview Questions and Answers

How to use this set