The Ultimate Cheat Sheet: Limits, Quotas & Decision Trees
The night before the exam, you do not need another 2,000-word article. You need the numbers, the limits, and the decision shortcuts that the exam tests repeatedly. This article is designed to be your “last look”—the quick reference that cements the critical facts in your memory.
VPC Limits
Resource
Default Limit
VPCs per project
5 (can be increased)
Subnets per VPC
100
Secondary IP ranges per subnet
30
Static routes per VPC
250
VPC Peering connections per VPC
25
Firewall rules per VPC
1,000
Alias IP ranges per VM
100
Load Balancer Limits
Resource
Limit
Backend services per URL Map
75
Certificates per Target HTTPS Proxy
15
NEGs per backend service
50
Health checks per project
50
Cloud NAT Limits
Resource
Limit
NAT gateways per Cloud Router
3
Default ports per VM
64
Maximum NAT external IPs
300
Decision Tree: Which Load Balancer?
Is the traffic HTTP(S)?
Yes → HTTP(S) Load Balancer.
Global or Regional? → If Global Anycast needed: Global External. If internal microservices: Internal Regional.
No → Continue.
Is the traffic TCP (non-HTTP)?
Need SSL termination? → SSL Proxy LB.
Need original client IP? → External Passthrough Network LB.
Internal? → Internal TCP/UDP LB.
Is the traffic UDP?
→ External Passthrough Network LB or Internal TCP/UDP LB.
Decision Tree: PGA vs. PSA vs. PSC
Do you need to reach Google APIs (Storage, BigQuery)?
Yes → Private Google Access (PGA). Enable on the subnet.
Do you need a private IP for a managed service (Cloud SQL, Redis)?
Yes → Private Service Access (PSA). Allocate an IP range for peering.
Do you need cross-org connectivity or a consumer-controlled endpoint?
Yes → Private Service Connect (PSC). Create a PSC endpoint.
Decision Tree: Interconnect vs. VPN
Bandwidth > 2 Gbps needed? → Interconnect.
In a Google colocation facility? → Dedicated Interconnect.
Not in a colo but need private connectivity? → Partner Interconnect.
Need encrypted connectivity in minutes? → HA VPN.
Need both encryption and private backbone? → VPN over Interconnect.
Quick-Reference: Key IP Ranges
Purpose
Range
Health check probes
35.191.0.0/16, 130.211.0.0/22
IAP tunnel source
35.235.240.0/20
Private Google Access (standard)
199.36.153.8/30
Restricted Google Access (VPC-SC)
199.36.153.4/30
GCP Metadata Server
169.254.169.254
Default DNS resolver
169.254.169.254
Memorize the health check ranges and the IAP range. They appear in nearly every firewall troubleshooting question.
Putting it Together
This cheat sheet is not a substitute for understanding—it is a supplement. Print it, review it the night before, and walk into the exam with these numbers fresh in your mind. The decision trees will save you 30 seconds per question. Over 50 questions, that is 25 minutes reclaimed—enough time to double-check your hardest answers.
