Interview Prep

A reference model that splits networking into seven layers, each handles one concern and talks to the layer above/below.

A bitmask that splits an IP into network vs host portions. AND with IP → network address.

DNS maps human-readable names to IPs (and other records). Hierarchical, distributed database.

Dynamic Host Configuration Protocol, automates IP assignment and options (gateway, DNS, lease time).

RFC 1918 ranges not routable on the public internet, reused behind NAT.

Address Resolution Protocol, maps IP → MAC on the same L2 segment.

Virtual LAN, logical broadcast domain on switches without rewiring. Tagged with 802.1Q VLAN ID on trunks.

Virtual Private Cloud, your private software-defined network in Google Cloud: subnets, routes, firewall, connectivity to on-prem and other VPCs.

Network Address Translation, many private hosts share one (or few) public IPs. Rewrites src/dst IP:port in packets.

A policy engine that permits or denies traffic based on rules (IP, port, protocol, identity, app).

Media Access Control, 48-bit (usually) hardware address on NICs. Unique per interface; used for L2 delivery on Ethernet.

Switches learn MAC → port via source frames.

Internet Control Message Protocol, diagnostics and errors for IP (not for app data like TCP payloads).

128-bit addresses, vastly larger space than IPv4; simplifies some features (SLAAC, larger headers options).

Content Delivery Network, edge caches close to users; origin shielded; lower latency for static assets.

Distributes traffic across healthy backends, improves capacity and availability.

NAT maintains a translation table: (private IP:port) ↔ (public IP:port). Outbound packets get SNAT; return traffic matches the session.

Synchronizes sequence numbers and confirms both sides can send/receive before data transfer.

Border Gateway Protocol, inter-domain routing on the internet. ASes exchange prefixes and path attributes (AS-PATH, communities).

Stateful VPC firewall, rules match direction, priority, targets (tags, SA, CIDR), and Layer 4 (and FQDN/region tags in some policies).

Managed SNAT for VMs without public IPs to reach the internet (outbound). Inbound initiated from internet not allowed without LB or IAP.

Default bridge creates a Linux bridge; containers get veth pairs; docker0 (or custom bridge) SNATs outbound via host IP.

Tags Ethernet frames with a 4-byte VLAN tag (TPID + TCI) so multiple VLANs share one physical trunk between switches.

IPsec tunnels between GCP HA VPN gateway and peer (on-prem or other cloud). Traffic encrypted over internet; routes via Cloud Router (BGP) or static.

Edge security policy for HTTP(S) Load Balancing, WAF rules, IP allow/deny lists, rate limiting, bot management, adaptive protection.

Lets VMs with only private IPs reach Google APIs and services (e.g. GCS, BigQuery) via Google’s private connectivity, no public internet for those calls.

Attacker sends fake ARP replies so victims map gateway IP to attacker MAC, MITM risk on L2.

Each layer wraps payload with its header; peer strips on receive. MTU shrinks as headers stack (e.g. IPsec, GRE).

Managed BGP speaker, exchanges routes with Cloud VPN, Cloud Interconnect, or partner attachments; creates dynamic routes in VPC.

API object + controller that programs an L7 proxy (e.g. GCE, nginx, GKE Ingress) with host/path rules to Services.

Mutual TLS, both client and server present certificates; strong service identity for east-west traffic (common in service mesh).

Classless Inter-Domain Routing, prefix length /n defines network size flexibly; ended waste of Class A/B/C rigid boundaries.

Use Shared VPC: host project for networking; each team = service project with subnets in agreed regions. Central firewall policies + hierarchical guardrails.

Global HTTPS LB → multi-MIG / serverless NEG in ≥2 regions. Spanner or replicated DB; GCS dual-region or multi-region. Health checks drive failover.

Security perimeter around Google-managed services, limits data exfil via compromised creds; defines ingress/egress policies to projects/VPCs.

Nodes in VPC subnets; Pod CIDR routes (VPC-native alias IPs). kube-proxy or eBPF dataplane; Ingress/Gateway API → GCLB.

Avoid overlap in design. If unavoidable: re-IP one side, or use NAT/custom routes so advertised prefixes don’t collide.

Private endpoint in consumer VPC to producer service, traffic stays on Google backbone; no public IPs required.

Identity-aware access (IAP), BeyondCorp-style: verify user + device + context every request, no trusted “inside.”

Cloud Router advertises VPC subnet routes (and custom learned routes) to peer over VPN/Interconnect; learns remote prefixes from peer.

L3/L4 rules enforced by CNI, select pods by labels/namespaces; allow ingress/egress to CIDR or pod selectors.

Cache static at edge; short TTL for HTML; versioned asset URLs; origin shield; split live vs VOD.

Host project owns VPC; standalone projects attach as service projects, use subnets granted by host admin.

Forecast VMs, GKE nodes, PSC, ILB proxies; reserve for auto-scaling; use secondary ranges for pods/services.

Org/folder-level policies that apply to VPC networks under them, enforce deny/allow guardrails project teams cannot weaken.

Managed Anthos Service Mesh or Istio on GKE, sidecar or ambient; mTLS, traffic policies, observability.

Area 0 backbone; other areas connect through ABRs, contains LSA flooding, speeds SPF, improves stability.

Inbound/outbound forwarding zones; Cloud DNS ↔ on-prem BIND with conditional forwarding; split-horizon for private zones.

Redundant VLAN attachments in same/different metros; BGP over multiple paths; LAG on-prem where possible.

Each pod gets an IP (CNI); same-node pods share bridge; cross-node via overlay or routed VPC.

Global anycast or geo-DNS → regional LBs; stateless tiers scale horizontally; data layer with conflict-free strategy (CRDT, sharding, or active-passive DB per shard).

Few Shared VPCs per environment; folder hierarchy maps to policy; centralized DNS and egress; project factory with CIDR pools.

Authoritative DNS at multiple POPs with same IP anycast; low TTL for failover; health checks steer bad edges.

Edge compute + cache; keep data near users; avoid cross-region chatter; WebSockets/gRPC keep-alive; premium backbone.

RTO/RPO drive design: cold/warm/hot DR site; DNS failover; replicate VPC configs as IaC; runbooks for BGP/LB cutover.

Hub transit (cloud router appliance or native) with consistent segmentation; avoid flat peering mesh; centralized logging.

Google edge absorbs volumetric; Cloud Armor rate limits + geo blocks + adaptive protection; origin only sees scrubbed traffic.

PCI/HIPAA-style zones: CDE isolated; jump hosts + IAP; no direct internet to data tier; audit all east-west.

Start with IdP + SSO; SD-WAN or hub-spoke VPN; split offices into sites; RFC1918 plan; later add ZTNA instead of flat VPN.