How should I use these Scenario practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Scenario questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Scenario domain.

PCNE · topic practice

Scenario practice questions

Practise Google Professional Cloud Network Engineer Scenario practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

7 questionsDomain: Scenario

Practice 10 questions Browse domain →

What the exam tests

What to know about Scenario

Scenario questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Scenario exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Scenario questions

7 questions · select your answer, then reveal the explanation

Question 1easymultiple choice

Open the full BGP breakdown →

An organization has an on-premises router that only supports static routing and does not support BGP. They need private connectivity to a single Google Cloud VPC. Which solution should they use?

Trap 1: Cloud VPN with dynamic routing (BGP)

On-prem router does not support BGP, so cannot use dynamic routing.

Trap 2: Ha VPN with policy-based routing

HA VPN requires BGP; policy-based is not available for HA VPN.

Trap 3: Partner Interconnect with BGP

Partner Interconnect requires BGP.

Study all Scenario common traps →

A
Cloud VPN with dynamic routing (BGP)
Why wrong: On-prem router does not support BGP, so cannot use dynamic routing.
B
Ha VPN with policy-based routing
Why wrong: HA VPN requires BGP; policy-based is not available for HA VPN.
C
Dedicated Interconnect with static routing
Dedicated Interconnect supports configuring static routes for the VLAN attachment without needing BGP.
D
Partner Interconnect with BGP
Why wrong: Partner Interconnect requires BGP.

Full breakdown with real-world context →

Question 2easymultiple choice

Read the full Scenario explanation →

An e-commerce website uses Cloud CDN to cache static content. The origin is an external HTTP load balancer. What is the benefit of enabling Cloud CDN in this scenario?

Trap 1: It eliminates the need for SSL certificates.

SSL is still needed between CDN and clients, and between CDN and origin.

Trap 2: It provides DDoS protection only.

Cloud CDN provides some DDoS protection, but the main benefit is latency reduction; Cloud Armor is for advanced DDoS protection.

Trap 3: It increases compute instance capacity.

Cloud CDN does not increase compute capacity; it offloads requests from origin.

Study all Scenario common traps →

A
It eliminates the need for SSL certificates.
Why wrong: SSL is still needed between CDN and clients, and between CDN and origin.
B
It provides DDoS protection only.
Why wrong: Cloud CDN provides some DDoS protection, but the main benefit is latency reduction; Cloud Armor is for advanced DDoS protection.
C
It increases compute instance capacity.
Why wrong: Cloud CDN does not increase compute capacity; it offloads requests from origin.
D
It reduces latency by serving content from edge locations.
Content is cached at edges closer to users, reducing round-trip time.

Full breakdown with real-world context →

Question 3easymultiple choice

Read the full NAT/PAT explanation →

A company has a VPC with subnet 10.1.0.0/24 in us-central1. They created a Cloud NAT gateway named 'nat-us-central1' attached to that subnet. During peak hours, many VM instances in the subnet cannot connect to the internet. The NAT configuration shows only one NAT IP. Firewall rules allow egress traffic, and health checks confirm the NAT gateway is functioning. What is the most likely cause of the failure?

Network Topology

Trap 1: The Cloud Router is missing or misconfigured.

Cloud Router is required for NAT; the command output shows the NAT exists, indicating the router is present.

Trap 2: The NAT gateway is not attached to the correct subnet.

The exhibit shows the NAT is described, and the subnet is presumably attached.

Trap 3: An egress firewall rule blocks ICMP packets.

Port exhaustion affects all outbound connections, not just ICMP.

Study all Scenario common traps →

A
The Cloud Router is missing or misconfigured.
Why wrong: Cloud Router is required for NAT; the command output shows the NAT exists, indicating the router is present.
B
The NAT gateway is not attached to the correct subnet.
Why wrong: The exhibit shows the NAT is described, and the subnet is presumably attached.
C
An egress firewall rule blocks ICMP packets.
Why wrong: Port exhaustion affects all outbound connections, not just ICMP.
D
Port exhaustion due to insufficient NAT IP addresses.
One NAT IP provides limited source ports, easily exhausted by many concurrent connections.

Full breakdown with real-world context →

Question 4mediummultiple choice

Read the full Scenario explanation →

A company uses Identity-Aware Proxy (IAP) to secure access to a group of Compute Engine instances running a web application. The instances have no external IP addresses and are accessed via IAP TCP forwarding. Recently, the security team discovered that some users can access the instances directly via SSH from other instances within the same VPC, bypassing IAP. What is the most effective way to ensure all SSH access goes through IAP?

Trap 1: Assign a service account to each instance with the IAP-secured…

The IAP-secured Tunnel User role is granted to users, not instances.

Trap 2: Remove SSH keys from the instances and use OS Login.

OS Login still allows SSH access from within the VPC if firewall rules permit.

Trap 3: Create a new firewall rule that allows SSH only from the IAP IP…

Deleting the existing rule is not necessary; modifying it or adding a higher-priority deny rule is sufficient.

Study all Scenario common traps →

A
Modify the VPC firewall rule to deny ingress traffic on TCP port 22 from all sources except the IAP IP range (35.235.240.0/20).
This ensures only IAP can initiate SSH connections.
B
Assign a service account to each instance with the IAP-secured Tunnel User role.
Why wrong: The IAP-secured Tunnel User role is granted to users, not instances.
C
Remove SSH keys from the instances and use OS Login.
Why wrong: OS Login still allows SSH access from within the VPC if firewall rules permit.
D
Create a new firewall rule that allows SSH only from the IAP IP range and delete the existing SSH rule.
Why wrong: Deleting the existing rule is not necessary; modifying it or adding a higher-priority deny rule is sufficient.

Full breakdown with real-world context →

Question 5mediummultiple choice

Read the full NAT/PAT explanation →

An organization has a Cloud NAT configured for a VPC network to allow outbound internet access for private instances. They notice that some instances are failing to connect to a specific external API that requires a static source IP. What should they do to resolve this?

Trap 1: Use Private Google Access instead of Cloud NAT.

Private Google Access is for Google APIs and services, not for external APIs.

Trap 2: Assign a static external IP to the instances and use Cloud NAT with…

Assigning static IPs to instances is possible but not the best approach; Cloud NAT with a static IP is simpler and provides a single egress IP.

Trap 3: Use a VPN tunnel to the API provider's network.

A VPN is complex and overkill; Cloud NAT with static IP is simpler.

Study all Scenario common traps →

A
Use Private Google Access instead of Cloud NAT.
Why wrong: Private Google Access is for Google APIs and services, not for external APIs.
B
Assign a static external IP to the instances and use Cloud NAT with static IPs.
Why wrong: Assigning static IPs to instances is possible but not the best approach; Cloud NAT with a static IP is simpler and provides a single egress IP.
C
Configure Cloud NAT with a static NAT IP address and ensure all traffic uses that IP.
This provides a consistent source IP for all outbound traffic, meeting the API's requirement.
D
Use a VPN tunnel to the API provider's network.
Why wrong: A VPN is complex and overkill; Cloud NAT with static IP is simpler.

Full breakdown with real-world context →

Question 6easymultiple choice

Read the full VPN explanation →

A customer wants to use Cloud VPN to connect a small branch office to Google Cloud. The branch office has a dynamic public IP address. Which Cloud VPN type should they use?

Trap 1: Classic VPN with a static IP on the peer

Classic VPN requires a static peer IP; dynamic IP would cause the tunnel to fail after IP changes.

Trap 2: A custom SSL VPN appliance on Compute Engine

SSL VPN is not a native Cloud VPN service and adds complexity.

Trap 3: HA VPN with two VPN gateways and static peer IPs

HA VPN supports dynamic peer IPs; two gateways are not required for a branch.

Study all Scenario common traps →

A
Classic VPN with a static IP on the peer
Why wrong: Classic VPN requires a static peer IP; dynamic IP would cause the tunnel to fail after IP changes.
B
A custom SSL VPN appliance on Compute Engine
Why wrong: SSL VPN is not a native Cloud VPN service and adds complexity.
C
HA VPN with a single VPN gateway and a dynamic peer IP
HA VPN supports dynamic peer IP addresses, making it suitable for branches with dynamic IPs.
D
HA VPN with two VPN gateways and static peer IPs
Why wrong: HA VPN supports dynamic peer IPs; two gateways are not required for a branch.

Full breakdown with real-world context →

Question 7hardmultiple choice

Open the full BGP breakdown →

Refer to the exhibit. The Cloud Router is configured with custom BGP advertisements. The on-premises router receives only the two advertised ranges (10.1.0.0/24 and 10.2.0.0/24) but not the VPC subnets (e.g., 10.3.0.0/24). What is the most likely reason?

Exhibit

Refer to the exhibit.

$ gcloud compute routers describe router-us

bgp:
  advertiseMode: CUSTOM
  advertisedGroups:
  - ALL_SUBNETS
  advertisedIpRanges:
  - range: 10.1.0.0/24
  - range: 10.2.0.0/24
  asn: 65000
  keepaliveInterval: 20
bgpPeers:
- interfaceName: if-bgp
  ipAddress: 169.254.1.1
  peerIpAddress: 169.254.1.2
  peerAsn: 65001
  advertisedRoutePriority: 100

Trap 1: The on-premises router is configured to accept only prefixes longer…

The VPC subnet is /24 as well, so it should be accepted.

Trap 2: The advertised route priority of 100 is too high, causing the…

Priority doesn't affect advertisement.

Trap 3: The Cloud Router's custom advertisement includes both the…

The configuration seems correct; the issue is likely on the on-premises side.

Study all Scenario common traps →

A
The on-premises router is configured to accept only prefixes longer than /24.
Why wrong: The VPC subnet is /24 as well, so it should be accepted.
B
The advertised route priority of 100 is too high, causing the routes to be ignored.
Why wrong: Priority doesn't affect advertisement.
C
The Cloud Router's custom advertisement includes both the ALL_SUBNETS group and the explicit ranges, so all subnets should be advertised.
Why wrong: The configuration seems correct; the issue is likely on the on-premises side.
D
The on-premises router is filtering routes based on the BGP community or AS path.
On-premises routers often have ingress filters that can drop routes.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Scenario sessions

Start a Scenario only practice session

Every question in these sessions is drawn from the Scenario domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Scenario questions →Mixed PCNE session

Frequently asked questions

What does the PCNE exam test about Scenario?: Scenario questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Scenario questions in a focused session?: Yes — the session launcher on this page draws every question from the Scenario domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other PCNE topics?: Use the topic links above to move to related areas, or go back to the PCNE question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the PCNE exam covers. They are not copied from any real exam or dump site.

Scenario only

10 questions 20 questions 30 questions 50 questions

Mixed PCNE session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All PCNE questions Scenario domain overview PCNE exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Scenario practice questions

What to know about Scenario

Common Scenario exam traps

Scenario questions

An organization has an on-premises router that only supports static routing and does not support BGP. They need private connectivity to a single Google Cloud VPC. Which solution should they use?

An e-commerce website uses Cloud CDN to cache static content. The origin is an external HTTP load balancer. What is the benefit of enabling Cloud CDN in this scenario?

An organization has a Cloud NAT configured for a VPC network to allow outbound internet access for private instances. They notice that some instances are failing to connect to a specific external API that requires a static source IP. What should they do to resolve this?

A customer wants to use Cloud VPN to connect a small branch office to Google Cloud. The branch office has a dynamic public IP address. Which Cloud VPN type should they use?

Refer to the exhibit. The Cloud Router is configured with custom BGP advertisements. The on-premises router receives only the two advertised ranges (10.1.0.0/24 and 10.2.0.0/24) but not the VPC subnets (e.g., 10.3.0.0/24). What is the most likely reason?

Exhibit

Track your progress over time

Start a Scenario only practice session

Related PCNE topic practice pages

Designing, planning, and prototyping a GCP network practice questions

Implementing hybrid interconnectivity practice questions

Configuring network services practice questions

Implementing network security practice questions

Implementing a Virtual Private Cloud practice questions

PCNE fundamentals practice questions

PCNE scenario practice questions

PCNE troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid