EnglishDeutschFrançaisEspañolPortuguês

Google Cloud · GCP-PCNE · Advanced

Professional Cloud Network Engineer — Practice Questions and Mock Exam

The Professional Cloud Network Engineer certification validates expertise in designing, implementing, and managing Google Cloud network infrastructure, including architecting networks for high availability, scalability, resiliency, and security.

Practice for freeTry a practice question first
Try a practice question firstPractice for free
Start practicing GCP-PCNE freeBuy GCP-PCNE access for $29.99
55Questions per Pass-IT mock exam
120minPass-IT mock exam time limit

Checked against Google Cloud · October 2026 · Current exam version

Try Pass-IT

See what learning with Pass-IT is like.

Answer a GCP-PCNE sample question and read the explanation with its source. Right here, with no sign-up.

Configuring and implementing hybrid and multicloud network interconnectivity1 / 5

You built an HA VPN gateway and configured a single tunnel from HA VPN interface 0 to the single external IP address of the on-premises peer gateway. BGP is established and traffic flows, but an audit finds that the deployment does not qualify for the 99.99% availability SLA. What should you change?

AlexFull explanation from Alex

HA VPN gateways always expose two interfaces with two external IP addresses in different Google Cloud edge availability zones, and the SLA follows the tunnel layout rather than the peer's interface count. If the peer has two interfaces you match interface 0 to peer interface 0 and interface 1 to peer interface 1; if the peer has one interface, both HA VPN interfaces terminate tunnels on it. A full mesh is explicitly not required for the 99.99% SLA on the Google Cloud side, although some VPN vendors recommend one.

Sourcecloud.google.com

Configuring, implementing and managing a cloud network security solution2 / 5

Your organization uses hierarchical firewall policies at the org level and VPC firewall rules. With the default AFTER_CLASSIC_FIREWALL order, what is the evaluation sequence?

AlexFull explanation from Alex

Per official docs (cloud.google.com/firewall/docs/firewall-policies-rule-eval-order), the AFTER_CLASSIC_FIREWALL enforcement order evaluates: (1) Hierarchical firewall policies, (2) Regional system firewall policies, (3) VPC firewall rules, (4) Global network firewall policies, (5) Regional network firewall policies, (6) Implied firewall rules. Hierarchical policies always evaluate first regardless of enforcement order. AFTER_CLASSIC_FIREWALL (default) preserves backward compatibility by evaluating legacy VPC rules before newer network firewall policies. Each level can allow, deny, or use goto_next to continue evaluation. The option “VPC rules, then hierarchical policies…” reverses hierarchical and VPC order. The options “Hierarchical policies, then network policies…” and “Network policies, then hierarchical policies…” incorrectly place network policies before VPC rules under the AFTER_CLASSIC setting. Ref: cloud.google.com/firewall/docs/firewall-policies-rule-eval-order.

Sourcedocs.cloud.google.com

Managing, monitoring, and troubleshooting network operations3 / 5

You have deployed a VPN tunnel but notice the tunnel is established but no traffic is flowing. BGP sessions show as established but no routes are being exchanged. What is the most likely cause?

AlexFull explanation from Alex

When a VPN tunnel is established (IKE succeeded) and BGP sessions show established but no traffic flows, the cause is no routes being advertised. Per docs (cloud.google.com/network-connectivity/docs/router/concepts/advertised-routes), Cloud Router has two advertisement modes: default (advertises subnet ranges automatically) and custom (requires explicit prefix configuration). If Cloud Router is in custom mode with no prefixes configured, or the on-premises router has no BGP advertisements, neither side learns routes to reach the other's networks. IKE pre-shared key mismatch (the option “The IKE pre-shared key is incorrect”) would prevent tunnel establishment entirely. Cloud NAT (the option “Cloud NAT is interfering with the VPN traffic”) operates independently of VPN data-plane traffic. MTU issues (the option “The VPN tunnel MTU is set too low”) cause packet drops or fragmentation, not missing routes. Fix: verify Cloud Router advertisement mode and on-prem BGP exports. Ref: cloud.google.com/network-connectivity/docs/router/concepts/advertised-routes.

Sourcedocs.cloud.google.com

Implementing a VPC network4 / 5

You have a GKE cluster and want to configure source NAT (SNAT) so that Pod traffic leaving the cluster uses the node's IP address instead of the Pod's IP address. When should you configure IP Masquerade?

AlexFull explanation from Alex

IP masquerade (SNAT) in GKE replaces the Pod source IP with the node IP for outgoing traffic. Per docs (cloud.google.com/kubernetes-engine/docs/concepts/ip-masquerade-agent), this is needed when destinations outside the VPC lack routes to the Pod CIDR range—e.g., on-premises networks connected via VPN/Interconnect. Without SNAT, return traffic cannot route back to Pod IPs. GKE controls masquerading via the ip-masq-agent DaemonSet and its ConfigMap nonMasqueradeCIDRs list. The --disable-default-snat flag preserves Pod IPs for all destinations when no ip-masq-agent is present. Pod-to-Pod traffic within VPC-native clusters doesn't need SNAT (VPC has routes for Pod CIDRs). Pod-to-control-plane (the option “When Pods need to communicate with the GKE control plane”) and Private Google Access (the option “When Pods need to access Google Cloud APIs via Private…”) traffic routes within Google's network and doesn't require masquerading. Ref: cloud.google.com/kubernetes-engine/docs/concepts/ip-masquerade-agent.

Sourcedocs.cloud.google.com

Configuring managed network services5 / 5

Which Google Cloud load balancer type should you choose to load balance non-HTTP TCP traffic from external clients across backends in a single region while preserving the client's source IP address?

AlexFull explanation from Alex

Per docs (cloud.google.com/load-balancing/docs/passthrough-network-load-balancer), passthrough NLBs deliver packets with source/destination IPs unchanged—'packets are received by backend VMs with the packet's source and destination IP addresses, protocol, and ports unchanged.' The regional external passthrough NLB (built on Maglev) supports TCP, UDP, ESP, GRE, ICMP, and ICMPv6. It preserves client source IP natively via Direct Server Return (DSR). The option “Global external Application Load Balancer” (global external Application LB) handles HTTP(S) only, not arbitrary TCP. The option “Internal passthrough Network Load Balancer” (internal passthrough NLB) serves internal traffic, not external clients. The option “Regional external proxy Network Load Balancer” (regional external proxy NLB) terminates connections and creates new ones to backends, losing original source IP unless using PROXY protocol (HTTP-only headers won't work for non-HTTP). Ref: cloud.google.com/load-balancing/docs/passthrough-network-load-balancer.

Sourcecloud.google.com

How to prepare for GCP-PCNE with Pass-IT.

Currently 310 practice questions for GCP-PCNE, with new ones added regularly. Focus on what you still need to learn.

Get past difficult questions.

Understand why an answer is correct. Alex explains the concepts and answers your follow-up questions so you can apply what you learn to the next task.

Meet Alex →

Conversation preview · GCP-PCNE

BGP without route advertisements

  1. You

    The BGP session is up but no routes arrive. What should I check?

  2. Alex · AI tutor

    Inspect Cloud Router’s advertisement mode and the prefixes configured for that session.

    Read the documentation ↗
  3. You

    Why does custom mode matter?

  4. Alex · AI tutor

    Custom advertisements must include the intended ranges; an established session alone does not supply them.

    Read the documentation ↗

Make your study time count.

Practice at your level.
For new practice sessions, Pass-IT adjusts the difficulty based on your previous answers.

Learn from mistakes.
Incorrect answers automatically become flashcards. When you review them, you rate how confidently you remember; Pass-IT schedules the next review.

See how focused practice works →

Animated feature preview

Turn your mistakes into knowledge you can rely on.

How Pass-IT works

Your review

Answered a question incorrectly?

Pass-IT saves it for your review.

GCP-PCNE · Question excerpt

BGP without route advertisements

View the full question

You have deployed a VPN tunnel but notice the tunnel is established but no traffic is flowing. BGP sessions show as established but no routes are being exchanged. What is the most likely cause?

Understand the correct answer.

The Cloud Router is not advertising any routes and the on-premises router is not advertising routes either

Check the advertised prefixes when BGP is established but routes are missing.

Read the documentation ↗

How confidently do you remember?

During review, you assess how well you still know the answer.

Correct after hesitating

Pass-IT schedules your next review.

The date depends on your self-assessment and previous reviews.

Simplified demonstration. No learning progress is saved.

Practice for the moment that counts.

Take a full mock exam with a time limit and find out whether you can finish in time.

Your GCP-PCNE mock exam

Questions
55
Minutes
120

Illustration of an exam session

  1. Start
  2. Answer questions
  3. Finish

Length and time limit of the Pass-IT mock exam.

Go into your exam with more confidence.

Your Readiness Score helps you assess whether you are ready for the exam. Results by exam domain show you where you should keep practicing.

Your money back if you fail despite 80% Readiness.
If your Readiness Score is at least 80% when you take the exam and you still fail, we refund the Pass-IT purchase price for this certification.

For active, paid access. Submit proof of failing within 14 days.

Further guarantee conditions

You need at least 80% Readiness and active, paid access to the certification when you take the exam. Take the exam within your access period and submit official proof of failing within 14 days after the exam.

For purchases through Apple or Google, refunds are handled by the respective store. See the full terms for further details.

Read the guarantee terms →

The Readiness Score describes your practice progress, not a probability of passing.

Guarantee requirement

80%

At least 80% Readiness
when you take the exam

Money back if you fail

Question counts and mock exam settings from the current Pass-IT catalog.

Exam domains

What you practice for GCP-PCNE.

Exam topics, relevant practice and sources you can check.

Planning VPC and hybrid networksSee the guide for weighting62 QuestionsPass-IT questions

Design network layouts that meet connectivity, resilience and growth requirements.

  • Plan availability, DNS, load balancing, network tiers, IAM permissions, managed-service access and quotas.
  • Choose standalone or Shared VPC layouts, interconnections and address ranges, including IPv6, overlap handling, MTU and appliance routing.
  • Design hybrid and multicloud connections with VPN, Interconnect or peering, considering bandwidth, encryption, private API access and hybrid DNS.
  • Plan GKE node and control-plane access, primary and secondary address ranges, node pools and load balancing.
Official certification objectives
Implementing VPCs and GKE networkingSee the guide for weighting59 QuestionsPass-IT questions

Configure networks, routes and cluster connectivity.

  • Create VPCs and subnets, expand existing subnet ranges, configure peering and Shared VPC permissions, and control access to Google services with private access and VPC Service Controls.
  • Configure static, dynamic and policy-based routes, priorities, regional or global routing and route exchange between networks.
  • Set up Network Connectivity Center spokes and topologies, address filters, Private NAT and Private Service Connect propagation, then troubleshoot connectivity.
  • Configure VPC-native GKE clusters, control-plane endpoints, Pod and Service ranges, Dataplane V2, network policies, source NAT and DNS.
Official certification objectives
Managed network servicesSee the guide for weighting56 QuestionsPass-IT questions

Configure how applications distribute traffic, cache content and resolve names.

  • Choose and configure load balancers, backends, health checks, affinity and traffic rules, including GKE Gateway, Ingress and network endpoint groups.
  • Enable Cloud CDN for Google Cloud or external origins and invalidate cached content when needed.
  • Migrate to Cloud DNS, manage zones, records, routing policies and DNSSEC, and integrate private, hybrid, cross-project and GKE name resolution.
Official certification objectives
Connecting hybrid and multicloud networksSee the guide for weighting48 QuestionsPass-IT questions

Implement connectivity between cloud networks and external sites.

  • Configure Dedicated, Partner or Cross-Cloud Interconnect, VLAN attachments and HA VPN over Interconnect with the required availability topology.
  • Configure site-to-site HA VPN or Classic VPN for on-premises gateways and other VPCs.
  • Set Cloud Router BGP attributes, route advertisements, learned routes, BFD and best-path selection.
  • Create Network Connectivity Center hybrid spokes and router appliances for site-to-site traffic and resolve transit limitations.
Official certification objectives
Monitoring and troubleshooting networksSee the guide for weighting41 QuestionsPass-IT questions

Use logs, metrics and network diagnostics to find connectivity problems.

  • Collect and review network logs and metrics for VPN, Interconnect, routers, load balancers, firewalls, DNS and NAT.
  • Manage traffic changes and diagnose VPN, Interconnect and BGP failures with flow logs, firewall logs and Packet Mirroring.
  • Use Network Intelligence Center tools to inspect topology, test routes and firewalls, and identify latency, packet loss and configuration problems.
Official certification objectives
Protecting network trafficSee the guide for weighting44 QuestionsPass-IT questions

Apply controls to incoming, internal and outgoing traffic.

  • Configure Cloud Armor policies for web attacks, DDoS protection, rate limits, bots and threat intelligence.
  • Design and manage VPC firewall rules and Cloud NGFW policies, including hierarchy, microsegmentation, logging, migration and layer 7 inspection.
  • Configure public Cloud NAT addresses and port allocation and use Secure Web Proxy to control outbound web access.
  • Route traffic through highly available virtual appliances and configure policy-based routes and Packet Mirroring for inspection.
Official certification objectives
Question formats you can practice
Multiple Choice
Select one answer.
Multiple Response
Select multiple applicable answers.

These are practice formats in Pass-IT. See the Official certification objectives for the official exam requirements.

Frequently asked questions

Your preparation

How much study time should I plan for GCP-PCNE?

For planning, Pass-IT estimates roughly 60–150 hours. Relevant experience may put you toward the lower end; starting from scratch may put you toward the higher end. Your needs may fall outside this range. This is not a time requirement from Google Cloud or a promise that you will be exam-ready within that time.

What experience does the Cloud Network Engineer exam assume?

Google Cloud recommends three or more years in the industry with at least one year on its own platform, and requires nothing. The catalog budget is around 100 hours. Traditional networking experience transfers well, but the hybrid connectivity section is specific to Google Cloud products and has to be learned from scratch.

Using Pass-IT

What language are Pass-IT questions in?

Questions in the app are currently in English. Translations of the sample questions on this page apply only to this preview. Check with Google Cloud for the languages available for the official exam.

How long does my GCP-PCNE access last?

Access covers this certification for 12 months. You pay once, with no automatic renewal.

When does the money-back guarantee apply?

The guarantee refunds the Pass-IT purchase price for this certification. You need eligible paid access and a Readiness Score of at least 80% from your practice results when you take the exam. This score can only reach 80% after at least 50 answered questions and is not a validated probability of passing. Take the exam during your access period and submit official proof of failing within 14 days. Guarantee terms

About the GCP-PCNE exam

Where can I take the GCP-PCNE exam?

Online-proctored (Pearson VUE) or onsite-proctored at testing centers.

Which cloud certification is best for a network engineer?

On Google Cloud it is this one: Professional Cloud Network Engineer is four fifths VPC design, implementation, managed services and hybrid connectivity. The equivalents elsewhere are Microsoft AZ-700 for Azure networking and, on the vendor-neutral side, CompTIA Network+ for the underlying fundamentals. Pick by the platform your employer runs, since the concepts transfer but the exams do not.

How long does the Cloud Network Engineer certification last?

Two years, with renewal inside an eligibility window before the expiry date. There is no continuing-education route, so the renewal is an exam.

How soon can you retake the Cloud Network Engineer exam?

Fourteen days after the first failure, 60 days after the second and 365 days after the third. Google Cloud applies this escalation across its whole professional range.

Your preparation for GCP-PCNE

$29.99one-time

12 months of access for GCP-PCNE · No automatic renewal

Buy GCP-PCNE access

Questions in the app are currently in English.

Try 20 questions for freeFree account required. No credit card.

Already have an account? Log in

Prefer a subscription? View subscriptions →

Money back if you fail with at least 80% Readiness, for eligible purchases under the guarantee terms.

Guarantee terms

The guarantee refunds the Pass-IT purchase price for this certification. You need eligible paid access and a Readiness Score of at least 80% from your practice results when you take the exam. This score can only reach 80% after at least 50 answered questions and is not a validated probability of passing. Take the exam during your access period and submit official proof of failing within 14 days.

Full guarantee terms →

Related certifications

Associate Cloud EngineerAssociate Data PractitionerAssociate Google Workspace AdministratorCloud Digital LeaderAll Google Cloud certifications →