How should I use these Scenario practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Scenario questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Scenario domain.

PCNE · topic practice

Scenario practice questions

Practise Google Professional Cloud Network Engineer Scenario practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

9 questionsDomain: Scenario

Practice 10 questions Browse domain →

What the exam tests

What to know about Scenario

Scenario questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Scenario exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Scenario questions

9 questions · select your answer, then reveal the explanation

Question 1easymultiple choice

Read the full VPN explanation →

A customer wants to use Cloud VPN to connect a small branch office to Google Cloud. The branch office has a dynamic public IP address. Which Cloud VPN type should they use?

Trap 1: Classic VPN with a static IP on the peer

Classic VPN requires a static peer IP; dynamic IP would cause the tunnel to fail after IP changes.

Trap 2: A custom SSL VPN appliance on Compute Engine

SSL VPN is not a native Cloud VPN service and adds complexity.

Trap 3: HA VPN with two VPN gateways and static peer IPs

HA VPN supports dynamic peer IPs; two gateways are not required for a branch.

Study all Scenario common traps →

A
Classic VPN with a static IP on the peer
Why wrong: Classic VPN requires a static peer IP; dynamic IP would cause the tunnel to fail after IP changes.
B
A custom SSL VPN appliance on Compute Engine
Why wrong: SSL VPN is not a native Cloud VPN service and adds complexity.
C
HA VPN with a single VPN gateway and a dynamic peer IP
HA VPN supports dynamic peer IP addresses, making it suitable for branches with dynamic IPs.
D
HA VPN with two VPN gateways and static peer IPs
Why wrong: HA VPN supports dynamic peer IPs; two gateways are not required for a branch.

Full breakdown with real-world context →

Question 2mediummultiple choice

Read the full NAT/PAT explanation →

An organization has a Cloud NAT configured for a VPC network to allow outbound internet access for private instances. They notice that some instances are failing to connect to a specific external API that requires a static source IP. What should they do to resolve this?

Trap 1: Use Private Google Access instead of Cloud NAT.

Private Google Access is for Google APIs and services, not for external APIs.

Trap 2: Assign a static external IP to the instances and use Cloud NAT with…

This option fails because assigning static external IPs directly to instances bypasses the purpose of Cloud NAT, which is to *provide* a static source IP for *multiple* private instances from a single, shared NAT IP. While tempting because it directly addresses the static IP requirement, it's the wrong approach when the goal is to manage outbound access for a group of instances via a central NAT gateway, not to individually assign public IPs.

Trap 3: Use a VPN tunnel to the API provider's network.

A VPN tunnel establishes a private, encrypted connection to the API provider’s network, but it does not alter the source IP address of outbound traffic from the private instances. The requirement is for a static, predictable source IP that the external API can whitelist; a VPN merely routes traffic through a different path without providing a fixed public IP. This option is tempting because VPNs are commonly used for secure site-to-site connectivity, and would be correct if the API provider required private network access rather than a static source IP for firewall rules.

Study all Scenario common traps →

A
Use Private Google Access instead of Cloud NAT.
Why wrong: Private Google Access is for Google APIs and services, not for external APIs.
B
Assign a static external IP to the instances and use Cloud NAT with static IPs.
Why wrong: This option fails because assigning static external IPs directly to instances bypasses the purpose of Cloud NAT, which is to *provide* a static source IP for *multiple* private instances from a single, shared NAT IP. While tempting because it directly addresses the static IP requirement, it's the wrong approach when the goal is to manage outbound access for a group of instances via a central NAT gateway, not to individually assign public IPs.
C
Configure Cloud NAT with a static NAT IP address and ensure all traffic uses that IP.
This provides a consistent source IP for all outbound traffic, meeting the API's requirement.
D
Use a VPN tunnel to the API provider's network.
Why wrong: A VPN tunnel establishes a private, encrypted connection to the API provider’s network, but it does not alter the source IP address of outbound traffic from the private instances. The requirement is for a static, predictable source IP that the external API can whitelist; a VPN merely routes traffic through a different path without providing a fixed public IP. This option is tempting because VPNs are commonly used for secure site-to-site connectivity, and would be correct if the API provider required private network access rather than a static source IP for firewall rules.

Full breakdown with real-world context →

Question 3easymultiple choice

Review the full routing breakdown →

An engineer is configuring a Compute Engine instance with multiple network interfaces for use as a network appliance. Which interface is considered the primary interface for default routes and instance metadata?

Trap 1: Any interface with an external IP

The primary interface is determined by index, not by external IP assignment.

Trap 2: The interface with the lowest subnet CIDR

The primary interface is always NIC0.

Trap 3: The interface attached to the default VPC

Not necessarily; the primary interface is always NIC0 regardless of VPC.

Study all Scenario common traps →

A
Any interface with an external IP
Why wrong: The primary interface is determined by index, not by external IP assignment.
B
The interface with the lowest subnet CIDR
Why wrong: The primary interface is always NIC0.
C
The interface attached to the default VPC
Why wrong: Not necessarily; the primary interface is always NIC0 regardless of VPC.
D
NIC0
Correct. NIC0 is the primary interface.

Full breakdown with real-world context →

Question 4hardmultiple choice

Open the full VLAN trunking answer →

A company is using Partner Interconnect with a 2 Gbps VLAN attachment. They notice that throughput is only about 500 Mbps during peak hours. They have verified that the on-premises link is not saturated. What is the most likely cause?

Trap 1: Cloud Router is not using the partner's ASN

The ASN does not affect throughput.

Trap 2: The VPC MTU is set to 1500 bytes

MTU influences packet size but not aggregate throughput to this extent.

Trap 3: The on-premises router does not support BGP multipath

While multipath helps, it is not the primary cause for a single VLAN attachment.

Study all Scenario common traps →

A
The VLAN attachment is configured with a lower bandwidth cap
VLAN attachments have a configurable bandwidth limit (e.g., 500 Mbps, 1 Gbps). If set lower than the physical link, throughput will be capped.
B
Cloud Router is not using the partner's ASN
Why wrong: The ASN does not affect throughput.
C
The VPC MTU is set to 1500 bytes
Why wrong: MTU influences packet size but not aggregate throughput to this extent.
D
The on-premises router does not support BGP multipath
Why wrong: While multipath helps, it is not the primary cause for a single VLAN attachment.

Full breakdown with real-world context →

Question 5hardmultiple choice

Review the full routing breakdown →

An engineer is troubleshooting asymmetric routing between two VPCs connected via VPC peering. They notice that return traffic takes a different path. What is a common cause of asymmetric routing in this scenario?

Trap 1: VPC Flow Logs are not enabled

Flow Logs are monitoring, not routing.

Trap 2: The MTU is mismatched between the VPCs

MTU mismatch causes drops, not routing asymmetry.

Trap 3: Firewall rules are blocking the return traffic

Firewall rules would drop traffic, not cause asymmetry.

Study all Scenario common traps →

A
VPC Flow Logs are not enabled
Why wrong: Flow Logs are monitoring, not routing.
B
One VPC has a more specific route that overrides the peering route
Correct: If one VPC has a more specific route (e.g., via VPN) for the other VPC's subnet, return traffic may go that way, causing asymmetry.
C
The MTU is mismatched between the VPCs
Why wrong: MTU mismatch causes drops, not routing asymmetry.
D
Firewall rules are blocking the return traffic
Why wrong: Firewall rules would drop traffic, not cause asymmetry.

Full breakdown with real-world context →

Question 6easymulti select

Read the full Scenario explanation →

Which TWO situations are most appropriate for using Partner Interconnect instead of Dedicated Interconnect?

Trap 1: When you need IPSec encryption

IPsec encryption can be used with both interconnect types; this is not a distinguishing reason to choose Partner over Dedicated.

Trap 2: When 99.99% SLA is required

Dedicated Interconnect typically offers a higher SLA (99.99%) compared to Partner Interconnect (99.9%), so Partner is not preferred for this requirement.

Trap 3: When bandwidth requirements exceed 10 Gbps per connection

Dedicated Interconnect supports bandwidth up to 100 Gbps per connection, while Partner Interconnect is typically limited to 10 Gbps per VLAN attachment, so Partner is not suitable for bandwidth exceeding 10 Gbps.

Study all Scenario common traps →

A
When you need IPSec encryption
Why wrong: IPsec encryption can be used with both interconnect types; this is not a distinguishing reason to choose Partner over Dedicated.
B
When 99.99% SLA is required
Why wrong: Dedicated Interconnect typically offers a higher SLA (99.99%) compared to Partner Interconnect (99.9%), so Partner is not preferred for this requirement.
C
When data center space is limited and you cannot host a Google edge router
Correct. If you cannot host a Google edge router because of limited data center space, Partner Interconnect allows you to connect through a service provider's facility, avoiding the need for direct colocation.
D
When bandwidth requirements exceed 10 Gbps per connection
Why wrong: Dedicated Interconnect supports bandwidth up to 100 Gbps per connection, while Partner Interconnect is typically limited to 10 Gbps per VLAN attachment, so Partner is not suitable for bandwidth exceeding 10 Gbps.
E
When you want to leverage existing service provider connectivity
Correct. Partner Interconnect leverages connectivity from a provider that already connects to Google Cloud, simplifying setup and reducing the need for new infrastructure.

Full breakdown with real-world context →

Question 7easymultiple choice

Read the full NAT/PAT explanation →

A company has a VPC with subnet 10.1.0.0/24 in us-central1. They created a Cloud NAT gateway named 'nat-us-central1' attached to that subnet. During peak hours, many VM instances in the subnet cannot connect to the internet. The NAT configuration shows only one NAT IP. Firewall rules allow egress traffic, and health checks confirm the NAT gateway is functioning. What is the most likely cause of the failure?

Network Topology

Trap 1: The Cloud Router is missing or misconfigured.

Cloud Router is required for NAT; the command output shows the NAT exists, indicating the router is present.

Trap 2: The NAT gateway is not attached to the correct subnet.

The exhibit shows the NAT is described, and the subnet is presumably attached.

Trap 3: An egress firewall rule blocks ICMP packets.

Port exhaustion affects all outbound connections, not just ICMP.

Study all Scenario common traps →

A
The Cloud Router is missing or misconfigured.
Why wrong: Cloud Router is required for NAT; the command output shows the NAT exists, indicating the router is present.
B
The NAT gateway is not attached to the correct subnet.
Why wrong: The exhibit shows the NAT is described, and the subnet is presumably attached.
C
An egress firewall rule blocks ICMP packets.
Why wrong: Port exhaustion affects all outbound connections, not just ICMP.
D
Port exhaustion due to insufficient NAT IP addresses.
One NAT IP provides limited source ports, easily exhausted by many concurrent connections.

Full breakdown with real-world context →

Question 8easymultiple choice

Read the full Scenario explanation →

An e-commerce website uses Cloud CDN to cache static content. The origin is an external HTTP load balancer. What is the benefit of enabling Cloud CDN in this scenario?

Trap 1: It eliminates the need for SSL certificates.

SSL is still needed between CDN and clients, and between CDN and origin.

Trap 2: It provides DDoS protection only.

Cloud CDN provides some DDoS protection, but the main benefit is latency reduction; Cloud Armor is for advanced DDoS protection.

Trap 3: It increases compute instance capacity.

Cloud CDN does not increase compute capacity; it offloads requests from origin.

Study all Scenario common traps →

A
It eliminates the need for SSL certificates.
Why wrong: SSL is still needed between CDN and clients, and between CDN and origin.
B
It provides DDoS protection only.
Why wrong: Cloud CDN provides some DDoS protection, but the main benefit is latency reduction; Cloud Armor is for advanced DDoS protection.
C
It increases compute instance capacity.
Why wrong: Cloud CDN does not increase compute capacity; it offloads requests from origin.
D
It reduces latency by serving content from edge locations.
Content is cached at edges closer to users, reducing round-trip time.

Full breakdown with real-world context →

Question 9mediummultiple choice

Open the full BGP breakdown →

A network engineer is configuring a Cloud VPN tunnel with route-based VPN and BGP. The tunnel is established, but the Cloud Router does not learn any routes from the on-premises peer. What is the most likely cause?

Trap 1: Firewall rules on the on-prem router block UDP port 179.

Blocking UDP port 179 is not relevant because BGP uses TCP port 179. Even if the firewall blocks both TCP and UDP on the same port, this is not the most likely cause given the tunnel is established.

Trap 2: All of the above are possible causes.

Not all of the options are possible causes. Option A is not a direct cause (BGP uses TCP), and Option D is not a possible cause in this context.

Trap 3: The Cloud Router does not have an ASN configured.

A Cloud Router without an ASN would not establish a BGP session, but this is not listed as a typical cause in the other options. Given the tunnel is established, the missing BGP session configuration is more likely.

Study all Scenario common traps →

A
Firewall rules on the on-prem router block UDP port 179.
Why wrong: Blocking UDP port 179 is not relevant because BGP uses TCP port 179. Even if the firewall blocks both TCP and UDP on the same port, this is not the most likely cause given the tunnel is established.
B
The BGP session is not configured on the VPN tunnel.
The BGP session must be configured on the VPN tunnel interface. Without this configuration, the Cloud Router cannot exchange routes with the on-premises peer, making this the most likely cause.
C
All of the above are possible causes.
Why wrong: Not all of the options are possible causes. Option A is not a direct cause (BGP uses TCP), and Option D is not a possible cause in this context.
D
The Cloud Router does not have an ASN configured.
Why wrong: A Cloud Router without an ASN would not establish a BGP session, but this is not listed as a typical cause in the other options. Given the tunnel is established, the missing BGP session configuration is more likely.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Scenario sessions

Start a Scenario only practice session

Every question in these sessions is drawn from the Scenario domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Scenario questions →Mixed PCNE session

Frequently asked questions

What does the PCNE exam test about Scenario?: Scenario questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Scenario questions in a focused session?: Yes — the session launcher on this page draws every question from the Scenario domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other PCNE topics?: Use the topic links above to move to related areas, or go back to the PCNE question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the PCNE exam covers. They are not copied from any real exam or dump site.

Scenario only

10 questions 20 questions 30 questions 50 questions

Mixed PCNE session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All PCNE questions Scenario domain overview PCNE exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Scenario practice questions

What to know about Scenario

Common Scenario exam traps

Scenario questions

A customer wants to use Cloud VPN to connect a small branch office to Google Cloud. The branch office has a dynamic public IP address. Which Cloud VPN type should they use?

An organization has a Cloud NAT configured for a VPC network to allow outbound internet access for private instances. They notice that some instances are failing to connect to a specific external API that requires a static source IP. What should they do to resolve this?

An engineer is configuring a Compute Engine instance with multiple network interfaces for use as a network appliance. Which interface is considered the primary interface for default routes and instance metadata?

A company is using Partner Interconnect with a 2 Gbps VLAN attachment. They notice that throughput is only about 500 Mbps during peak hours. They have verified that the on-premises link is not saturated. What is the most likely cause?

An engineer is troubleshooting asymmetric routing between two VPCs connected via VPC peering. They notice that return traffic takes a different path. What is a common cause of asymmetric routing in this scenario?

Which TWO situations are most appropriate for using Partner Interconnect instead of Dedicated Interconnect?

An e-commerce website uses Cloud CDN to cache static content. The origin is an external HTTP load balancer. What is the benefit of enabling Cloud CDN in this scenario?

A network engineer is configuring a Cloud VPN tunnel with route-based VPN and BGP. The tunnel is established, but the Cloud Router does not learn any routes from the on-premises peer. What is the most likely cause?

Track your progress over time

Start a Scenario only practice session

Related PCNE topic practice pages

Configuring Network Services practice questions

Managing, Monitoring, and Optimising Network Operations practice questions

Implementing Hybrid Interconnectivity practice questions

Designing, Planning, and Prototyping a GCP Network practice questions

Implementing VPC Instances practice questions

Implementing network security practice questions

Implementing a Virtual Private Cloud practice questions

PCNE fundamentals practice questions

PCNE scenario practice questions

PCNE troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid