EN简体繁體
Sign in
Home / Google / GCP-CNE
Google · GCP-CNE

GCP-CNE Exam Practice Questions

Google Professional Cloud Network Engineer

GCP-CNE English PDF practice questions: 316 questions in source order, with options supported by the source format, answers and available explanations. Access covers this exam only. One-time payment; no automatic renewal.

Exam overview

For cloud network engineers designing VPCs, network services and hybrid connectivity, and operating network solutions.

Exam code
GCP-CNE
Official exam / credential
Google Professional Cloud Network Engineer
Exam format
50–60 single-answer and multiple-select questions (standard exam)
Exam duration
120 minutes
Official exam languages
English, Japanese

Official exam languages and practice-question file languages are listed separately. Confirm the exam version and available languages when booking with the provider.

Official sources: Provider reference
Information checked: 2026-10-20

Supported languages

  • English
  • Simplified Chinese
  • Japanese
Try before you buy

First 20 practice questions

316 total questions

Questions follow the source order. Expand each answer to see its explanation.

Disclaimer: All questions on ExamPico are compiled from internet sources and are provided for study reference only.

Question 6

Question#6Topic1

You are using a third-party next-generation firewall to inspect traffic. You created a custom route of 0.0.0.0/0 to route egress traffic to the firewall. You want to allow your VPC instances without public IP addresses to access the BigQuery and Cloud Pub/Sub APIs, without sending the traffic through the firewall.
Which two actions should you take? (Choose two.)

  1. A. Turn on Private Google Access at the subnet level.
  2. B. Turn on Private Google Access at the VPC level.
  3. C. Turn on Private Services Access at the VPC level.
  4. D. Create a set of custom static routes to send traffic to the external IP addresses of Google APIs and services via the default internet gateway.
  5. E. Create a set of custom static routes to send traffic to the internal IP addresses of Google APIs and services via the default internet gateway.
Show answer and explanation

Answer

AD

Explanation

Requires Private Google Access - https://cloud.google.com/vpc/docs/private-access-options#pga

Question 7

Question#7Topic1

All the instances in your project are configured with the custom metadata enable-oslogin value set to FALSE and to block project-wide SSH keys. None of the instances are set with any SSH key, and no project-wide SSH keys have been configured. Firewall rules are set up to allow SSH sessions from any IP address range. You want to SSH into one instance.
What should you do?

  1. A. Open the Cloud Shell SSH into the instance using gcloud compute ssh.
  2. B. Set the custom metadata enable-oslogin to TRUE, and SSH into the instance using a third-party tool like putty or ssh.
  3. C. Generate a new SSH key pair. Verify the format of the private key and add it to the instance. SSH into the instance using a third-party tool like putty or ssh.
  4. D. Generate a new SSH key pair. Verify the format of the public key and add it to the project. SSH into the instance using a third-party tool like putty or ssh.
Show answer and explanation

Answer

A

Explanation

1) Created VM 2) Set enable-oslogin FALSE ( in compute engine metadata) as well in VM's metadata 3) None of the instances are set with any SSH key, and no project-wide SSH keys have been configured (set block project wide ssh key on VM) 4) firewall allow for tcp:22 5) Try to ssh from cloud shell and web console, worked able to ssh into VM

Question 8

Question#8Topic1

You work for a university that is migrating to GCP.
These are the cloud requirements:
'¢ On-premises connectivity with 10 Gbps
'¢ Lowest latency access to the cloud
'¢ Centralized Networking Administration Team
New departments are asking for on-premises connectivity to their projects. You want to deploy the most cost-efficient interconnect solution for connecting the campus to Google Cloud.
What should you do?

  1. A. Use Shared VPC, and deploy the VLAN attachments and Interconnect in the host project.
  2. B. Use Shared VPC, and deploy the VLAN attachments in the service projects. Connect the VLAN attachment to the Shared VPC's host project.
  3. C. Use standalone projects, and deploy the VLAN attachments in the individual projects. Connect the VLAN attachment to the standalone projects' Interconnects.
  4. D. Use standalone projects and deploy the VLAN attachments and Interconnects in each of the individual projects.
Show answer

Answer

A

Question 9

Question#9Topic1

You have deployed a new internal application that provides HTTP and TFTP services to on-premises hosts. You want to be able to distribute traffic across multiple
Compute Engine instances, but need to ensure that clients are sticky to a particular instance across both services.
Which session affinity should you choose?

  1. A. None
  2. B. Client IP
  3. C. Client IP and protocol
  4. D. Client IP, port and protocol
Show answer

Answer

B

Question 10

Question#10Topic1

You created a new VPC network named Dev with a single subnet. You added a firewall rule for the network Dev to allow HTTP traffic only and enabled logging.
When you try to log in to an instance in the subnet via Remote Desktop Protocol, the login fails. You look for the Firewall rules logs in Stackdriver Logging, but you do not see any entries for blocked traffic. You want to see the logs for blocked traffic.
What should you do?

  1. A. Check the VPC flow logs for the instance.
  2. B. Try connecting to the instance via SSH, and check the logs.
  3. C. Create a new firewall rule to allow traffic from port 22, and enable logs.
  4. D. Create a new firewall rule with priority 65500 to deny all traffic, and enable logs.
Show answer and explanation

Answer

D

Explanation

https://cloud.google.com/blog/products/identity-security/google-cloud-firewall-rules-logging-how-and-why-you-should-use-it "Since we have implicit ingress and the denial rule is not being logged, we create a “deny all” rule with priority 65534 to capture anything that gets denied" https://cloud.google.com/vpc/docs/firewall-rules-logging

Downloads and personal use

  • Purchase this exam question set separately with 1, 3, 6 or 12 months of download access.
  • After payment confirmation, your library shows the download link and exact expiry time.
  • Download again during your term. Purchase a new term after expiry.
  • PDFs are licensed for personal study only and must not be resold or shared publicly.
  • Files already saved to your device are not remotely deleted when access expires.
How to choose your certification