4.3.2. Routes, DNS, NAT, and Firewall Management
💡 First Principle: Once a network is live, ongoing route, DNS, and NAT management is about directing traffic correctly without exposing anything that shouldn't be reachable from outside — each of these tools controls a different piece of that "where does traffic go, and can the outside world initiate it" question.
Custom static routes override Google Cloud's default routing behavior within a VPC, directing traffic matching specific destination ranges to a particular next hop (useful for routing through a network virtual appliance, for example). Cloud DNS provides managed, authoritative DNS hosting, including private zones resolvable only within a VPC. Cloud NAT provides outbound-only internet access for instances that have no external IP, without exposing them to unsolicited inbound connections. Ongoing firewall rule and Cloud NGFW policy management means adjusting existing rules as requirements evolve — adding, removing, or tightening rules rather than the initial from-scratch design covered in Phase 3.
⚠️ Exam Trap: Cloud NAT allows external clients to initiate inbound connections to private instances — a natural assumption given "NAT" is associated generally with internet connectivity, but Cloud NAT is strictly outbound-only; it lets a private instance reach the internet, not the reverse. A scenario needing inbound reachability for a private instance needs a load balancer or a bastion/IAP-based access pattern instead.
Reflection Question: A private Compute Engine instance with no external IP needs to download software updates from the public internet, but must never be reachable from the internet itself. Which feature satisfies exactly this asymmetric requirement?
