Google Cloud Certified Professional Cloud Network Engineer (PCNE) practice questions

Domain coverage 5 domains

• Designing and planning a Google Cloud network
• Implementing VPC networks
• Configuring managed network services
• Implementing hybrid interconnectivity
• Managing, monitoring, and troubleshooting network operations

Sample questions 8 of 80 shown

1. Q1 Designing, Planning, and Prototyping a GCP Network

   You are a network administrator at your company planning a migration to Google Cloud and you need to finish the migration as quickly as possible. To ease the transition, you decided to use the same architecture as your on-premises network: a hub-and-spoke model. Your on-premises architecture consists of over 50 spokes. Each spoke does not have connectivity to the other spokes, and all traffic is sent through the hub for security reasons. You need to ensure that the Google Cloud architecture matches your on-premises architecture. You want to implement a solution that minimizes management overhead and cost, and uses default networking quotas and limits. What should you do?

   1. Connect all the spokes to the hub with Cloud VPN.
   2. Connect all the spokes to the hub with VPC Network Peering.
   3. Connect all the spokes to the hub with Cloud VPN. Use a third-party network appliance as a default gateway to prevent connectivity between the spokes.
   4. Connect all the spokes to the hub with VPC Network Peering. Use a third-party network appliance as a default gateway to prevent connectivity between the spokes.

   C. Cloud VPN with a third-party NVA at the hub prevents spoke-to-spoke communication (all traffic through hub). VPC Peering (B/D) has a 25-peering limit, insufficient for 50+ spokes. Without NVA (A), spokes could communicate directly.
2. Q2 Designing, Planning, and Prototyping a GCP Network

   You are responsible for designing a new connectivity solution between your organization's on-premises data center and your Google Cloud Virtual Private Cloud (VPC) network. Currently, there is no end-to-end connectivity. You must ensure a service level agreement (SLA) of 99.99% availability. What should you do?

   1. Use one Dedicated Interconnect connection in a single metropolitan area. Configure one Cloud Router and enable global routing in the VPC.
   2. Use a Direct Peering connection between your on-premises data center and Google Cloud. Configure Classic VPN with two tunnels and one Cloud Router.
   3. Use two Dedicated Interconnect connections in a single metropolitan area. Configure one Cloud Router and enable global routing in the VPC.
   4. Use HA VPN. Configure one tunnel from each interface of the VPN gateway to connect to the corresponding interfaces on the peer gateway on-premises. Configure one Cloud Router and enable global routing in the VPC.

   D. Dedicated Interconnect provides a private, physical connection with 99.9% or 99.99% SLA between on-premises and GCP. Cloud VPN (A) is over the internet with lower SLA. Direct Peering (B) doesn't provide VPC connectivity. Partner Interconnect (C) has lower capacity and SLA.
3. Q3 Designing, Planning, and Prototyping a GCP Network

   Your company is planning a migration to Google Kubernetes Engine. Your application team informed you that they require a minimum of 60 Pods per node and a maximum of 100 Pods per node. Which Pod per node CIDR range should you use?

   1. /24
   2. /25
   3. /26
   4. /28

   A. VPC with Global dynamic routing mode and GKE master global access enables pods in any region to reach the private master endpoint. Regional routing (B) limits access. Private cluster (C) blocks public. Public master (D) is insecure.
4. Q4 Designing, Planning, and Prototyping a GCP Network

   You are designing a packet mirroring policy as part of your network security architecture for your gaming workload. Your infrastructure is located in the us-west2 region and deployed across several zones: us-west2-a, us-west2-b, and us-west2-c. The infrastructure is running a web-based application on TCP ports 80 and 443 with other game servers that utilize the UDP protocol. You need to deploy packet mirroring policies and collector instances to monitor web application traffic while minimizing inter-zonal network egress costs. Following Google-recommended practices, how should you deploy the packet mirroring policies and collector instances?

   1. Crate three packet mirroring policies: one for each zone. Create one group of collector instances for the us-west2 region. Configure each packet mirroring policy to match traffic for its zone based on instance-tags, and create a filter for TCP traffic.
   2. Create one packet mirroring policy for the us-west2 region. Create one group of collector instances for the us-west2 region. Configure the packet mirroring policy to match traffic for web server instances based on instance-tags, and create a filter for TCP traffic.
   3. Create three packet mirroring policies: one for each zone. Create three groups of collector instances: one group for each zone. Configure each policy to match traffic for its zone based on instance-tags, and create a filter for TCP traffic.
   4. Create three packet mirroring policies: one for each zone. Create three groups of collector instances: one group for each zone. Configure each policy to match traffic for its zone based on subnets, and create a filter for TCP traffic.

   B. VPC Flow Logs with sampling and metadata capture VM traffic details for analysis. Packet Mirroring (A) copies full packets. Cloud Audit Logs (C) capture API calls. Cloud Monitoring (D) tracks metrics.
5. Q5 Designing, Planning, and Prototyping a GCP Network

   Your company recently migrated to Google Cloud. You configured separate Virtual Private Cloud (VPC) networks for Department A and Department B. You need to configure both VPC networks to have access to the same on-premises location through separate links with full isolation between the VPC networks. Your design must also query on-premises DNS servers from workloads in Google Cloud using conditional forwarding. You want to minimize operational overhead. What should you do?

   1. Customize the operating system DNS configuration files to target the on-premises DNS servers.
   2. Keep the different VPC networks from both departments isolated with different on-premises links, and separate Cloud DNS private zones and Cloud DNS forwarding zones.
   3. Peer Department A's and Department B's VPC networks to have all on-premises connectivity via a single VPC network. Use separate Cloud DNS private zones and Cloud DNS forwarding zones.
   4. Configure a Cloud DNS Peering zone in Department A's VPC network pointing to Department B's VPC and a Cloud DNS outbound forwarding zone in Department B's VPC network. Use separate on-premises links in each VPC network.

   D. VPC peering connects two VPC networks across projects for private communication. Shared VPC (A) connects projects within one org. Cloud VPN (B) connects to on-premises. Cloud NAT (C) provides internet access.
6. Q6 Designing, Planning, and Prototyping a GCP Network

   You are planning to use Terraform to deploy the Google Cloud infrastructure for your company. The design must meet the following requirements: • Each Google Cloud project must represent an internal project that your team will work on. • After an internal project is finished, the infrastructure must be deleted. • Each internal project must have its own Google Cloud project owner to manage the Google Cloud resources. • You have 10-100 projects deployed at a time. While you are writing the Terraform code, you need to ensure that the deployment is simple and the code is reusable with centralized management. What should you do? D.O Create a Shared VPC and service project for each internal project.

   1. Create a single project and single VPC for each internal project.
   2. Create a single Shared VPC and attach each Google Cloud project as a service project.
   3. Create a single project and additional VPCs for each internal project.

   C. Cloud Router with BGP sessions learns routes from on-premises and advertises VPC routes, providing dynamic routing. Static routes (A) don't support route exchange. Cloud NAT (B) provides internet access. VPC Peering (D) connects VPCs.
7. Q7 Designing, Planning, and Prototyping a GCP Network

   You have two VPCs: VPC A in Project A and VPC B in Project B. The VPCs are peered, and each VPC has VM instances in four zones. You are using the Network Intelligence Center Performance Dashboard to investigate the packet loss for traffic flows that start in VPC A and terminate in VPC B. You need the reported packet loss metric to have at least a 90% confidence level. What should you do?

   1. Ensure that each zone in each of the VPC networks has at least 10 compute instances. Look in Project A for the reported metric.
   2. Ensure that each zone in each of the VPC networks has at least 9 compute instances. Look in Project B for the reported metric.
   3. Ensure that each zone in each of the VPC networks has at least 9 compute instances. Look in Project A for the reported metric.
   4. Ensure that each zone in each of the VPC networks has at least 10 compute instances. Look in Project B for the reported metric.

   D. VPC peering connects the two VPCs for private cross-project communication. Shared VPC (A) is for projects under one org. Cloud VPN (B) connects to on-premises. Private Service Connect (C) provides private access to Google services.
8. Q8 Designing, Planning, and Prototyping a GCP Network

   You are designing a new network infrastructure for your customer in Google Cloud. Your customer requires a connection between two Google Cloud VPCs that must include a VPN tunnel. You want to follow Google-recommended practices while ensuring maximum availability of the connection. Which VPN configuration should you choose?

   1. Policy-based VPN using Classic VPN between the two Google Cloud VPCs
   2. Border Gateway Protocol (BGP)-based VPN using Classic VPN between the two Google Cloud VPCs
   3. Route-based VPN using Classic VPN between the two Google Cloud VPCs
   4. Border Gateway Protocol (BGP)-based VPN using HA VPN between the two Google Cloud VPCs

   A. HA VPN with a Cloud Router provides high-availability connectivity with BGP dynamic routing and automatic failover. Classic VPN (B) has no HA. Dedicated Interconnect (C) is physical. Direct Peering (D) is not for VPN.

Answer all 80 questions with instant feedback →

Reader reviews 114 ratings

• The question explanations for PCNE really dig into the AWS (or relevant) concepts. Helped me understand things at a deeper level.

  ★★★★★★ Hazel C.

• Just passed the PCNE certification. These questions were more challenging than the real exam, which is exactly how prep should be.

  ★★★★★ Liam H.

• I used this alongside video courses for PCNE prep. The questions helped solidify what I learned from the lectures.

  ★★★★★★ Aria N.

• I have tried many Google practice tests and this PCNE bank is by far the most accurate and well-organized.

  ★★★★★★ Kevin N.

• Really well-structured PCNE practice set. I like that you can attempt questions multiple times and it tracks your progress.

  ★★★★★★ Lucas W.

• The PCNE explanations are where this really stands out. Not just which answer is right but WHY the others are wrong.

  ★★★★★★ Aria H.

Frequently asked questions

Free study resources

Community-verified analysis of 48 questions from real test-taker discussions — 16 deep analyses and 20 FAQs.

More Google exams