Courseiva
← Back to Google Professional Cloud Network Engineer questions

Scenario-based practice

Refer to the Exhibit Practice Questions

Practise Google Professional Cloud Network Engineer practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice testRead exam guide
15
scenario questions
PCNE
exam code
Google Cloud
vendor

Scenario guide

How to approach refer to the exhibit practice questions

Practise exhibit-style questions that ask you to read a topology, table, command output or diagram before choosing the best answer.

Quick answer

Exhibit-style questions test whether you can read a topology, command output, diagram or table before choosing the best answer.

How to extract the relevant detail from an exhibit.

How topology, command output or routing information affects the answer.

How to avoid answering from memory before reading the evidence.

How to map the exhibit back to the exam objective.

Related practice questions

Related PCNE topic practice pages

Scenario questions usually connect to one or more exam topics. Use these links to review the underlying concepts behind the scenario.

Configuring Network Services practice questions

Sharpen your PCNE knowledge of Configuring Network Services.

Managing, Monitoring, and Optimising Network Operations practice questions

Work through PCNE questions on Managing, Monitoring, and Optimising Network Operations.

Implementing Hybrid Interconnectivity practice questions

Work through PCNE questions on Implementing Hybrid Interconnectivity.

Designing, Planning, and Prototyping a GCP Network practice questions

Practise PCNE questions linked to Designing, Planning, and Prototyping a GCP Network.

Implementing VPC Instances practice questions

Sharpen your PCNE knowledge of Implementing VPC Instances.

Implementing network security practice questions

Sharpen your PCNE knowledge of Implementing network security.

Implementing a Virtual Private Cloud practice questions

Implementing a Virtual Private Cloud practice questions for PCNE.

PCNE fundamentals practice questions

Practise PCNE questions linked to PCNE fundamentals.

PCNE scenario practice questions

Targeted PCNE practice covering PCNE scenario.

PCNE troubleshooting practice questions

PCNE troubleshooting practice questions for PCNE.

Practice set

Practice scenarios

Question 1mediummulti select
Full question →

A company is using Network Connectivity Center (NCC) to connect multiple on-premises sites and GCP VPCs in a hub-and-spoke topology. Which TWO statements about NCC are correct?

Question 2easymultiple choice
Open the full BGP breakdown →

Based on the exhibit, what is the purpose of Cloud Router's BGP configuration?

Exhibit

Refer to the exhibit.

```
Resource: Cloud Router
Name: router-1
Region: us-central1
Network: vpc-1
BGP: Autonomous System Number (ASN): 65001
Advertised IP ranges: 10.0.0.0/16
BGP sessions:
  - peer: on-prem-router
    peer ASN: 65002
    peer IP: 192.168.1.1
    Cloud Router IP: 169.254.0.1
    Advertised route priority: 100
    Status: Established

On-premises router BGP table:
  Network          Next Hop        Metric
  10.0.0.0/16      169.254.0.1     0
  0.0.0.0/0        192.168.1.1     0
```
Question 3hardmultiple choice
Full question →

Refer to the exhibit. A request arrives with User-Agent 'GoodBot' and path '/admin'. What action does Cloud Armor take?

Exhibit

Cloud Armor security policy 'my-policy' with rules:
- priority: 100, match: request headers: User-Agent: *BadBot*, action: deny(403)
- priority: 200, match: request headers: User-Agent: *GoodBot*, action: allow
- priority: 300, match: request path: /admin, action: deny(403)
- priority: 1000, default rule: allow
Question 4hardmultiple choice
Full question →

Refer to the exhibit. A Cloud Armor security policy with the shown rules is applied to an HTTPS load balancer. Users from IP 10.0.1.1 are reporting they cannot access the website. What is the issue?

Exhibit

{
  "rules": [
    {
      "action": "deny(403)",
      "priority": 1000,
      "match": {
        "versionedExpr": "SRC_IPS_V1",
        "config": {
          "srcIpRanges": ["10.0.0.0/8"]
        }
      }
    },
    {
      "action": "allow",
      "priority": 2000,
      "match": {
        "versionedExpr": "SRC_IPS_V1",
        "config": {
          "srcIpRanges": ["0.0.0.0/0"]
        }
      }
    }
  ]
}
Question 5mediummultiple choice
Review the full routing breakdown →

A company has two VPCs in different projects that need to communicate. They want to avoid using VPC peering due to the limit on the number of peerings and the need for transitive routing. Which GCP service can provide a hub-and-spoke topology to connect multiple VPCs and on-premises networks?

Question 6mediummulti select
Full question →

A company is planning to connect multiple VPCs in different projects to a common on-premises network using a hub-and-spoke topology. They want to use Network Connectivity Center (NCC). Which TWO components are required to set up this topology?

Question 7easymultiple choice
Full question →

A company needs to connect multiple on-premises sites and cloud VPCs in a hub-and-spoke topology using a fully managed service. Which Google Cloud service should they use?

Question 8mediummultiple choice
Open the full BGP breakdown →

Refer to the exhibit. A BGP session between a Cloud Router and an on-premises router is not establishing. The Cloud Router logs show 'BGP_OPEN_MSG_ERROR: unsupported capability'. What is the most likely issue?

Exhibit

Refer to the exhibit.

Log entry from Cloud Router:
```
{
  "jsonPayload": {
    "routerName": "cloud-router-us-1",
    "status": {
      "code": "BGP_OPEN_MSG_ERROR",
      "details": {
        "error": "BGP OPEN message error: unsupported capability"
      }
    }
  }
}
```
Question 9easymultiple choice
Review the full subnetting walkthrough →

A network engineer wants to see a real-time graphical representation of the topology of their VPC network, including instances, subnets, and load balancers. Which Network Intelligence Center tool should they use?

Question 10easymultiple choice
Full question →

Which Google Cloud service allows you to create a hub-and-spoke topology for connecting on-premises networks and VPCs?

Question 11easymultiple choice
Full question →

Refer to the exhibit. A VM in the default VPC with tag 'internal' and IP 10.128.1.2 is unable to communicate with another VM with IP 10.132.0.3 and tag 'internal'. What is the most likely cause?

Exhibit

$ gcloud compute firewall-rules describe allow-internal
allows:
- IPProtocol: tcp
  ports:
  - 0-65535
- IPProtocol: udp
  ports:
  - 0-65535
- IPProtocol: icmp
direction: INGRESS
disabled: false
name: allow-internal
network: default
priority: 1000
sourceRanges:
- 10.128.0.0/14
targetTags:
- internal
Question 12mediummultiple choice
Read the full DNS explanation →

Refer to the exhibit. A DNS managed zone is configured with private visibility and associated with a VPC network. A Compute Engine instance in a different VPC network tries to resolve 'test.example.com' but fails. What is the most likely reason?

Exhibit

gcloud dns managed-zones describe example-zone
creationTime: '2023-01-01T12:00:00.000Z'
description: Example private zone
dnsName: example.com.
id: '1234567890'
kind: dns#managedZone
name: example-zone
nameServers:
- ns-cloud-c1.googledomains.com
- ns-cloud-c2.googledomains.com
- ns-cloud-c3.googledomains.com
- ns-cloud-c4.googledomains.com
privateVisibilityConfig:
  networks:
  - networkUrl: https://www.googleapis.com/compute/v1/projects/my-project/global/networks/vpc1
visibility: private
Question 13hardmultiple choice
Full question →

An organization wants to implement a hub-and-spoke network topology in Google Cloud using VPC Network Peering. The hub VPC hosts shared services and the spoke VPCs host application workloads. They need to ensure that spokes can communicate with each other through the hub. Which additional configuration is required?

Question 14hardmultiple choice
Open the full BGP breakdown →

You run the command shown in the exhibit. Your on-premises network is connected to your VPC via a Cloud Router with two BGP sessions. You notice that your on-premises network receives routes for only the two custom IP ranges (10.0.1.0/24 and 10.0.2.0/24) but not for other subnets in the VPC. What is the most likely cause?

Exhibit

Refer to the exhibit.

```
# gcloud compute routers describe my-router --region us-central1
bgp:
  advertiseMode: CUSTOM
  advertisedGroups:
  - ALL_SUBNETS
  advertisedIpRanges:
  - range: 10.0.1.0/24
  - range: 10.0.2.0/24
bgpPeers:
- interfaceName: if-0
  ipAddress: 169.254.0.1
  peerIpAddress: 169.254.0.2
  peerAsn: 65001
  advertisedRoutePriority: 100
- interfaceName: if-1
  ipAddress: 169.254.1.1
  peerIpAddress: 169.254.1.2
  peerAsn: 65001
  advertisedRoutePriority: 100
```
Question 15mediummultiple choice
Full question →

Refer to the exhibit. What is the purpose of the --enable-private-ip-google-access flag?

Exhibit

Refer to the exhibit.

gcloud compute networks subnets create subnet-a \
    --network=my-vpc \
    --region=us-central1 \
    --range=10.0.1.0/24 \
    --secondary-range=10.1.0.0/16 \
    --enable-private-ip-google-access

These PCNE practice questions are part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style PCNE questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.