Courseiva
← Back to Google Professional Cloud Network Engineer questions

Scenario-based practice

Hard Difficulty Questions

Practise Google Professional Cloud Network Engineer practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice testRead exam guide
20
scenario questions
PCNE
exam code
Google Cloud
vendor

Scenario guide

How to approach hard difficulty questions

These are the questions most candidates get wrong. They require connecting multiple concepts, reading tricky output, or knowing edge-case behaviour that isn't on most study cards. Practising them trains you to operate under uncertainty — a necessary skill on the real exam.

Quick answer

Hard Difficulty Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Related practice questions

Related PCNE topic practice pages

Scenario questions usually connect to one or more exam topics. Use these links to review the underlying concepts behind the scenario.

Configuring Network Services practice questions

Sharpen your PCNE knowledge of Configuring Network Services.

Managing, Monitoring, and Optimising Network Operations practice questions

Work through PCNE questions on Managing, Monitoring, and Optimising Network Operations.

Implementing Hybrid Interconnectivity practice questions

Work through PCNE questions on Implementing Hybrid Interconnectivity.

Designing, Planning, and Prototyping a GCP Network practice questions

Practise PCNE questions linked to Designing, Planning, and Prototyping a GCP Network.

Implementing VPC Instances practice questions

Sharpen your PCNE knowledge of Implementing VPC Instances.

Implementing network security practice questions

Sharpen your PCNE knowledge of Implementing network security.

Implementing a Virtual Private Cloud practice questions

Implementing a Virtual Private Cloud practice questions for PCNE.

PCNE fundamentals practice questions

Practise PCNE questions linked to PCNE fundamentals.

PCNE scenario practice questions

Targeted PCNE practice covering PCNE scenario.

PCNE troubleshooting practice questions

PCNE troubleshooting practice questions for PCNE.

Practice set

Practice scenarios

Question 1hardmulti select
Full question →

You are configuring a VPC Service Controls perimeter to protect a project containing BigQuery datasets. Access should be allowed only from a specific VPC network and only for users with a specific access level. Which THREE components must you define? (Choose 3)

Question 2hardmulti select
Full question →

An organization needs to design a hybrid connectivity solution with 99.99% availability for a mission-critical application. They have a co-location facility near a GCP region. Which THREE components are required to meet this SLA?

Question 3hardmultiple choice
Review the full subnetting walkthrough →

A network engineer is troubleshooting connectivity issues between two Compute Engine instances in the same VPC but different subnets (us-east1 and europe-west1). The engineer suspects an MTU issue. What is the default MTU for traffic within Google Cloud, and what MTU should the engineer expect when packets traverse the internet?

Question 4hardmultiple choice
Open the full BGP breakdown →

A network engineer configured a Cloud Router with the BGP configuration shown. The on-premises router (AS 64512) is peering with the Cloud Router (AS 65001) over a Dedicated Interconnect VLAN attachment. The engineer notices that traffic from on-premises to Google Cloud is not being routed via this interconnect as expected. What is the most likely cause?

Exhibit

Refer to the exhibit.

```
# Cloud Router BGP configuration
router bgp 65001
 neighbor 169.254.0.1 remote-as 64512
 neighbor 169.254.0.1 ebgp-multihop 2
 neighbor 169.254.0.1 update-source loopback0
 address-family ipv4 unicast
  neighbor 169.254.0.1 route-map SET-MED in
  neighbor 169.254.0.1 route-map SET-LOCAL-PREF out
!
route-map SET-MED permit 10
 set metric 100
!
route-map SET-LOCAL-PREF permit 10
 set local-preference 200
```
Question 5hardmultiple choice
Review the full subnetting walkthrough →

You are using Serverless VPC Access to connect Cloud Run services to a VPC network. The connector is in us-central1 with a /28 subnet. You have a Cloud SQL instance (private IP) in the same region but in a different VPC network (peered). The Cloud Run service cannot reach the Cloud SQL instance. What is the most likely cause?

Question 6hardmultiple choice
Full question →

You are using Cloud CDN with a backend bucket and want to cache all responses regardless of Cache-Control headers. Which cache mode should you set?

Question 7hardmultiple choice
Read the full VPN explanation →

You are configuring an HA VPN tunnel between GCP and on-premises. The on-premises VPN device only supports IKEv1 and static routing. Which of the following is true regarding this setup?

Question 8hardmultiple choice
Read the full NAT/PAT explanation →

A company is using Cloud NAT for outbound traffic. They want to log when a connection fails due to resource exhaustion. Which logging feature should be enabled?

Question 9hardmultiple choice
Open the full BGP breakdown →

An organization has a Dedicated Interconnect with two VLAN attachments connected to two different edge availability domains (EADs). They want to use a single Cloud Router for both attachments. How many BGP sessions should be established on the Cloud Router?

Question 10hardmultiple choice
Review the full subnetting walkthrough →

An engineer is troubleshooting a VPC Network Peering connection between two VPCs. The peering is established, but traffic from VPC A to VPC B is not reaching a specific subnet. Both VPCs have custom routes. What is the most likely cause?

Question 11hardmulti select
Open the full BGP breakdown →

A network engineer is troubleshooting a BGP session between an on-premises router and a Cloud Router. The BGP session state is 'CONNECT' and never transitions to 'ESTABLISHED'. The engineer has verified that the Cloud Router and on-premises router have the same BGP ASN, and that the peer IP addresses are correctly configured. Which two additional steps should the engineer take to resolve this issue? (Choose TWO.)

Question 12hardmulti select
Read the full NAT/PAT explanation →

A company is using Cloud NAT for outbound internet access. They want to ensure that traffic from certain VMs always uses a specific set of NAT IPs for auditing purposes. Which three steps are necessary to achieve this? (Choose THREE.)

Question 13hardmultiple choice
Full question →

An application running on Google Kubernetes Engine (GKE) uses Traffic Director for traffic management with Envoy sidecars. You want to implement fault injection to test resilience by injecting a 50% failure rate on a subset of traffic. Which Traffic Director configuration should you use?

Question 14hardmulti select
Open the full BGP breakdown →

An engineer is troubleshooting a High Availability VPN setup. The VPN tunnels are established, but the BGP sessions are flapping. Which THREE factors could cause this? (Choose THREE.)

Question 15hardmultiple choice
Read the full DNS explanation →

A company has deployed an external HTTPS load balancer with a Cloud CDN backend. The load balancer uses a managed SSL certificate. Recently, the company updated their DNS record to point to a different IP address of a new load balancer. After the change, some users are still being served from the old load balancer's cache. The network engineer has confirmed that the DNS TTL has expired. What is the most likely cause of this issue?

Question 16hardmulti select
Full question →

Which THREE of the following are valid use cases for VPC Service Controls?

Question 17hardmultiple choice
Open the full BGP breakdown →

A company is experiencing asymmetric routing between their VPC and on-premises network over two Cloud VPN tunnels with different BGP sessions. Some traffic from GCP to on-premises is dropped by firewall stateful inspection on-premises. What is the most likely cause?

Question 18hardmultiple choice
Open the full BGP breakdown →

A company uses Cloud VPN tunnels to connect multiple sites to Google Cloud. They have a primary and a backup tunnel for redundancy, each with a different Cloud Router (both in the same region). BGP sessions are established on both routers. The network team notices that during a failover test, traffic fails over to the backup tunnel but then after 30 seconds, the backup tunnel traffic stops and does not recover until the primary tunnel comes back. The engineer finds that the backup Cloud Router is advertising the same routes as the primary, but the backup tunnel's BGP session shows that the routes are being withdrawn after 30 seconds. Additionally, the BGP session remains established. What is the most likely cause?

Question 19hardmultiple choice
Full question →

A global e-commerce company has deployed a web application across multiple GCP regions using an external HTTPS load balancer. Traffic is expected to originate from users worldwide. They want to minimize latency and improve user experience, while also ensuring that traffic is served from the nearest healthy backend. Which load balancing configuration should they use?

Question 20hardmultiple choice
Open the full BGP breakdown →

A company uses Cloud Router with BGP for dynamic routing between on-premises and GCP. They need to ensure that a specific subnet in GCP is preferred over a less specific learned route from on-premises. Which BGP attribute should they adjust on the Cloud Router?

These PCNE practice questions are part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style PCNE questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.