How many Troubleshooting Scenario Questions questions are on this page?

This page has 15 Troubleshooting Scenario Questions scenario questions for the PCNE exam, each with detailed explanations and wrong-answer analysis.

How should I approach PCNE scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Google Professional Cloud Network Engineer questions

Scenario-based practice

Troubleshooting Scenario Questions

Practise Google Professional Cloud Network Engineer practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

PCNE

exam code

Google Cloud

vendor

Scenario guide

How to approach troubleshooting scenario questions

These questions describe a network symptom and ask you to identify the root cause or the correct fix. They appear across all certification exams and reward systematic thinking over memorisation. The best candidates follow a consistent troubleshooting framework even under time pressure.

Quick answer

Troubleshooting Scenario Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1mediumdrag order

Read the full VPN explanation →

Drag and drop the steps to troubleshoot a VPN tunnel that is not passing traffic into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 2easymultiple choice

Read the full VPN explanation →

A developer created a Compute Engine instance in the default VPC network. The instance needs to communicate with an on-premises server over a Cloud VPN tunnel. The developer configured the VPN tunnel but the instances cannot ping the on-premises server. What is the most likely cause?

A
The subnet IP range overlaps with the on-premises network.
Why wrong: Default VPC uses Auto mode subnets with non-overlapping ranges; overlap is unlikely but would cause routing issues, not firewall.
B
The instance has IP forwarding disabled.
Why wrong: IP forwarding is required only for instances acting as routers, not for general communication.
C
The default VPC does not have a default route to the internet.
Why wrong: Default VPC has a default route (0.0.0.0/0) to the internet via the default internet gateway.
D
The firewall rules in the VPC are blocking ingress traffic from the on-premises network.
Default firewall rules allow only certain ingress; ICMP from on-premises is not allowed by default.

Full breakdown with real-world context →

Question 3mediummultiple choice

Open the full BGP breakdown →

Your company has deployed a hybrid cloud environment with a Cloud VPN tunnel between Google Cloud VPC and an on-premises data center. The VPC has a custom mode with subnet 10.0.1.0/24 in us-east1. On-premises uses subnet 192.168.1.0/24. The VPN tunnel is established using dynamic routing (BGP). Both sides advertise the correct prefixes. A Compute Engine VM in the VPC (10.0.1.10) can ping the on-premises gateway (192.168.1.1), but cannot ping a server on-premises (192.168.1.100). The on-premises network team confirms that 192.168.1.100 is reachable from the on-premises gateway. Firewall rules in GCP allow ingress from 192.168.1.0/24 to all VMs. What is the most likely cause?

A
The on-premises router does not have a route for the GCP subnet (10.0.1.0/24) pointing to the VPN tunnel.
Without a return route, the on-premises server sends replies through the default route (likely internet), causing asymmetric routing and packet drop.
B
The on-premises server is not configured with a default gateway pointing to the on-premises gateway.
Why wrong: If the server had no default gateway, it wouldn't be able to reach the on-premises gateway either.
C
The Cloud VPN tunnel is not configured with an IKE version supported by the on-premises device.
Why wrong: The tunnel is established (VM can ping on-premises gateway), so IKE configuration is fine.
D
A firewall rule on the GCP VPC is blocking ICMP traffic from 192.168.1.100.
Why wrong: The firewall rule allows ingress from the entire on-premises subnet, so this is not the cause.

Full breakdown with real-world context →

Question 4hardmulti select

Read the full NAT/PAT explanation →

A company is using Cloud NAT to allow private instances to access the internet. They notice that some instances are not able to reach certain external services. Which THREE steps should they take to troubleshoot?

A
Check if the external service is blocking the Cloud NAT IP addresses.
Some external services may block specific IP ranges, including NAT IPs.
B
Verify that the VPC firewall rules allow egress traffic from the instances.
Cloud NAT requires firewall rules to allow outbound traffic.
C
Ensure that the VPC has a default route to the internet gateway.
Why wrong: Cloud NAT automatically uses the default route; no explicit route to internet gateway needed.
D
Verify that the Cloud Router associated with Cloud NAT is healthy and has established BGP sessions.
Cloud NAT uses routes from Cloud Router; if BGP is down, NAT may not work properly.
E
Check the DNS resolution for the external service.
Why wrong: DNS resolution is not related to Cloud NAT functionality.

Full breakdown with real-world context →

Question 5mediummultiple choice

Open the full BGP breakdown →

A network engineer is troubleshooting a Cloud VPN tunnel that is not passing traffic. The tunnel status shows as established, and BGP sessions are up. However, traffic from an on-premises subnet (10.0.1.0/24) to a GCP subnet (192.168.1.0/24) is not working. What should the engineer check first?

A
Verify that the on-premises router is advertising the 10.0.1.0/24 prefix via BGP
If the prefix is not advertised, GCP will not have a route to reach it.
B
Ensure that the Cloud Router is configured with the correct BGP ASN
Why wrong: Incorrect ASN would prevent BGP session from establishing, but it is already up.
C
Check that GCP has a static route for 10.0.1.0/24 pointing to the VPN tunnel
Why wrong: With dynamic routing, routes are learned via BGP; static routes are not needed.
D
Check GCP firewall rules to allow ingress from 10.0.1.0/24
Why wrong: Firewall rules control inbound traffic; the issue is outbound from GCP to on-premises.

Full breakdown with real-world context →

Question 6hardmulti select

Read the full NAT/PAT explanation →

A company uses Cloud NAT to enable outbound internet access for private instances in a VPC. They notice that some instances are unable to connect to external services, while others can. The network team has verified that all instances have the same tags and are in the same subnet. Which TWO actions should the team take to troubleshoot the issue?

A
Ensure Cloud NAT is enabled in each zone where instances are located
Why wrong: Cloud NAT is regional; it covers all zones in the region.
B
Check Cloud NAT logs for port exhaustion
Port exhaustion can cause connection failures; Cloud NAT logs show when ports are depleted.
C
Verify that the instances have external IP addresses assigned
Why wrong: Cloud NAT works with instances that have only internal IPs; external IPs would bypass NAT.
D
Verify that the external service is not blocking the NAT IP addresses
External services may block or rate-limit requests from certain IPs, causing failures.
E
Review the health check configuration for the NAT gateway
Why wrong: Cloud NAT does not have health checks; it routes traffic directly.

Full breakdown with real-world context →

Question 7easymultiple choice

Read the full NAT/PAT explanation →

An engineer creates a Cloud NAT configuration as shown in the exhibit. The test-instance is created without an external IP address. However, the instance cannot reach the internet. What is the most likely cause?

Exhibit

Refer to the exhibit.

```
gcloud compute routers create nat-router \
    --network=my-vpc \
    --region=us-central1

gcloud compute routers nats create nat-config \
    --router=nat-router \
    --region=us-central1 \
    --nat-external-ip-pool=ip-address-1 \
    --nat-all-subnet-ip-ranges \
    --enable-logging

gcloud compute instances create test-instance \
    --zone=us-central1-a \
    --network=my-vpc \
    --subnet=subnet-a \
    --no-address
```

A
The subnet subnet-a is in a region different from us-central1
Cloud NAT covers only subnets in the same region as the NAT router. If subnet-a is in another region, it is not covered.
B
The Cloud Router is not in the same zone as the instance
Why wrong: Cloud Router is regional, not zonal; region us-central1 covers all zones in that region.
C
A firewall rule is blocking outbound traffic from the instance
Why wrong: By default, VPC firewall allows outbound connections; no explicit rule is mentioned.
D
Logging is enabled but not configured to send logs to Cloud Logging
Why wrong: Logging is optional and does not affect connectivity.

Full breakdown with real-world context →

Question 8easymulti select

Open the full VLAN trunking answer →

A company is troubleshooting connectivity issues between their on-premises network and Google Cloud over a Dedicated Interconnect. They can ping the VLAN attachment IP but cannot reach Compute Engine instances. Which TWO checks should they perform?

A
Verify that the on-premises network has IAM permissions to access instances
Why wrong: IAM is not a factor in network connectivity.
B
Confirm that the subnet routes for the instance IP ranges are present in the VPC
Routes must exist for return traffic.
C
Verify that VPC firewall rules allow traffic from the on-premises subnets
Firewall rules must permit the traffic.
D
Ensure that the VLAN attachment IP is in the same subnet as the instances
Why wrong: VLAN attachment IP is separate.
E
Check that BGP sessions are established between Cloud Router and on-premises router
Why wrong: BGP is not strictly required if static routes are used.

Full breakdown with real-world context →

Question 9hardmulti select

Open the full BGP breakdown →

A Cloud Router BGP session is flapping. Which TWO actions are appropriate troubleshooting steps?

A
Check the MTU size on the VPN tunnel or interconnect.
MTU mismatches can cause packet loss and BGP session drops.
B
Delete and recreate the VLAN attachment.
Why wrong: That is a destructive step; better to check configurations first.
C
Revert all BGP routes to static routes.
Why wrong: This is a drastic measure and not a troubleshooting step.
D
Verify BGP timers and hold time settings.
Incorrect timers can cause premature session termination.
E
Increase the bandwidth of the interconnect.
Why wrong: Bandwidth does not cause flapping; flapping is usually due to configuration or link stability.

Full breakdown with real-world context →

Question 10hardmulti select

Open the full BGP breakdown →

A network engineer is troubleshooting a BGP session between an on-premises router and a Cloud Router. The BGP session state is 'CONNECT' and never transitions to 'ESTABLISHED'. The engineer has verified that the Cloud Router and on-premises router have the same BGP ASN, and that the peer IP addresses are correctly configured. Which two additional steps should the engineer take to resolve this issue? (Choose TWO.)

A
Change the BGP ASN on the Cloud Router to a different number
Why wrong: They have verified the ASNs; this step might be needed only if ASN mismatch, but they said they are same. However, if same ASN, BGP may need 'allow-as' or 'as-override', but the question indicates they've already checked, so not the most likely next step.
B
Ensure the on-premises router has a route to the Cloud Router's BGP peer IP address
Without a return route, BGP packets cannot reach the Cloud Router.
C
Increase the BGP hold timer on the Cloud Router
Why wrong: Changing hold timer would not affect session establishment if the problem is connectivity.
D
Change the BGP keepalive interval to 10 seconds
Why wrong: Keepalive interval is not related to CONNECT state.
E
Verify the Cloud VPN tunnel is established and passing traffic
A non-working tunnel can prevent BGP from establishing.

Full breakdown with real-world context →

Question 11easymultiple choice

Full question →

Refer to the exhibit. A network engineer is unable to SSH to instance-1 using IAP TCP forwarding. What is the most likely reason?

Exhibit

gcloud compute instances describe instance-1 --format="yaml(tags, serviceAccounts)"
tags:
  items:
  - web
serviceAccounts:
- email: test@project.iam.gserviceaccount.com
  scopes:
  - https://www.googleapis.com/auth/cloud-platform

---

Firewall rule:
gcloud compute firewall-rules describe allow-ssh-iap
allowed:
- IPProtocol: tcp
  ports:
  - '22'
direction: INGRESS
priority: 1000
sourceRanges:
- 35.235.240.0/20
targetTags:
- ssh-iap

A
IAP TCP forwarding is not enabled for the project.
Why wrong: IAP is enabled at the project level by default; no additional enablement is needed.
B
The instance does not have the 'ssh-iap' tag that the firewall rule applies to.
The firewall rule only applies to instances with tag 'ssh-iap'.
C
The instance's service account does not have the necessary IAP permissions.
Why wrong: The service account is used for API calls, not for firewall rules.
D
SSH keys are not configured on the instance.
Why wrong: SSH keys are required but are not the reason given the firewall rule mismatch.

Full breakdown with real-world context →

Question 12hardmultiple choice

Open the full BGP breakdown →

A network engineer is troubleshooting an HA VPN setup between Google Cloud and an on-premises data center. The two tunnels are established, and BGP sessions are up on both tunnels. However, traffic from Google Cloud to the on-premises network is only using one tunnel, even though both BGP sessions are advertising the same routes. What is the most likely cause?

A
The on-premises router is sending different BGP metrics (MED) for the same route on the two BGP sessions.
If MED differs, Cloud Router will prefer lower MED, leading to single-path use.
B
The Cloud Router is not configured for dynamic routing.
Why wrong: Dynamic routing is enabled via BGP; if BGP sessions are up, routing is dynamic.
C
One of the IPsec tunnels is in a dead state.
Why wrong: If a tunnel is dead, BGP would also be down, not established.
D
The on-premises router is setting a higher local preference on one route.
Why wrong: Local preference is used for inbound decisions on the receiving router; it would affect on-premises routing to Google, not Google routing to on-premises.

Full breakdown with real-world context →

Question 13easymultiple choice

Read the full NAT/PAT explanation →

A company has a VPC with a subnet in us-central1. They have several private Compute Engine instances (no external IP) that need to download updates from a public repository on the internet. The network engineer has created a Cloud NAT gateway in the same region and attached it to the subnet. However, the instances still cannot reach the internet. The engineer has confirmed that the Cloud NAT gateway is correctly configured and that the subnet's Private Google Access is not relevant for this traffic. What should the engineer check first to resolve the issue?

A
Verify that the default route (0.0.0.0/0) is present in the VPC route table pointing to the internet gateway.
The default route is essential for internet-bound traffic to be routed to the NAT gateway.
B
Confirm that the Cloud NAT router is configured with the correct network and subnet.
Why wrong: The engineer already confirmed the NAT gateway is correctly configured.
C
Ensure that the Cloud NAT gateway has a static external IP.
Why wrong: Static IP is optional; Cloud NAT works with ephemeral IPs.
D
Check that the firewall rules allow egress traffic for the instances to the internet.
Why wrong: While needed, the first check should be the route; missing route is a more fundamental issue.

Full breakdown with real-world context →

Question 14mediummultiple choice

Open the full BGP breakdown →

A company has an on-premises data center connected to Google Cloud via a Dedicated Interconnect using VLAN attachments. They have set up a Cloud Router with BGP to exchange routes. The on-premises network advertises a prefix 10.0.0.0/8, and Google Cloud advertises the VPC's subnet ranges (10.0.0.0/24 and 10.0.1.0/24). After configuration, on-premises hosts cannot reach the Google Cloud instances in those subnets. The engineer checks the BGP session status and it is established. The Cloud Router shows that the on-premises prefix is learned, and the on-premises router shows that the specific /24 prefixes are received. However, traffic from on-premises to the Google Cloud subnets is not working. What is the most likely cause?

A
The on-premises router has a local route for 10.0.0.0/8 that overrides the BGP-learned /24 routes.
A local route with a lower administrative distance can shadow the BGP routes.
B
The VPN connection needs to be configured for the Interconnect.
Why wrong: The Interconnect is already configured; VPN is separate.
C
The Google Cloud VPC has a custom static route that overrides the dynamically learned route.
Why wrong: The problem is on the on-premises side, not Google Cloud.
D
The on-premises firewall is blocking the traffic.
Why wrong: While possible, the routing issue is more likely given the routing table situation.

Full breakdown with real-world context →

Question 15easymultiple choice

Read the full VPN explanation →

Your organization has a site-to-site Cloud VPN connection between an on-premises network with CIDR 10.0.0.0/8 and a VPC in us-central1 with subnet 192.168.1.0/24. The VPN tunnel is established, but you cannot reach a Compute Engine instance with internal IP 192.168.1.10 from a server on-premises with IP 10.0.0.50. Cloud VPN logs show no errors. On-premises firewall rules allow all outbound traffic. What is the most likely cause of the problem?

A
A firewall rule on the VPC blocking inbound traffic from 10.0.0.0/8
Why wrong: If a firewall rule blocked traffic, the logs would typically show denied packets; the question states no errors.
B
Missing a static route on the on-premises router for 192.168.1.0/24 pointing to the VPN gateway
Without a proper route on-premises, traffic to GCP may not be forwarded to the VPN peer.
C
The Compute Engine instance's OS firewall blocking ICMP
Why wrong: The question does not specify the protocol; still, route issue is more likely given tunnel is up.
D
Incorrect IAM permissions on the Cloud VPN gateway
Why wrong: IAM permissions are for managing VPN resources, not for traffic flow; the tunnel is established so permissions are sufficient.

Full breakdown with real-world context →

These PCNE practice questions are part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style PCNE questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Troubleshooting Scenario Questions

How to approach troubleshooting scenario questions

Quick answer

Related PCNE topic practice pages

Designing, planning, and prototyping a GCP network practice questions

Implementing hybrid interconnectivity practice questions

Configuring network services practice questions

Implementing network security practice questions

Implementing a Virtual Private Cloud practice questions

PCNE fundamentals practice questions

PCNE scenario practice questions

PCNE troubleshooting practice questions

Practice scenarios

Drag and drop the steps to troubleshoot a VPN tunnel that is not passing traffic into the correct order.

A developer created a Compute Engine instance in the default VPC network. The instance needs to communicate with an on-premises server over a Cloud VPN tunnel. The developer configured the VPN tunnel but the instances cannot ping the on-premises server. What is the most likely cause?

A company is using Cloud NAT to allow private instances to access the internet. They notice that some instances are not able to reach certain external services. Which THREE steps should they take to troubleshoot?

A network engineer is troubleshooting a Cloud VPN tunnel that is not passing traffic. The tunnel status shows as established, and BGP sessions are up. However, traffic from an on-premises subnet (10.0.1.0/24) to a GCP subnet (192.168.1.0/24) is not working. What should the engineer check first?

An engineer creates a Cloud NAT configuration as shown in the exhibit. The test-instance is created without an external IP address. However, the instance cannot reach the internet. What is the most likely cause?

Exhibit

A company is troubleshooting connectivity issues between their on-premises network and Google Cloud over a Dedicated Interconnect. They can ping the VLAN attachment IP but cannot reach Compute Engine instances. Which TWO checks should they perform?

A Cloud Router BGP session is flapping. Which TWO actions are appropriate troubleshooting steps?

Refer to the exhibit. A network engineer is unable to SSH to instance-1 using IAP TCP forwarding. What is the most likely reason?

Exhibit