EN简体繁體
Sign in
Home / Google / GCP-CNE
Google · GCP-CNE

GCP-CNE Exam Practice Questions

Google Professional Cloud Network Engineer

GCP-CNE English PDF practice questions: 316 questions in source order, with options supported by the source format, answers and available explanations. Access covers this exam only. One-time payment; no automatic renewal.

Exam overview

For cloud network engineers designing VPCs, network services and hybrid connectivity, and operating network solutions.

Exam code
GCP-CNE
Official exam / credential
Google Professional Cloud Network Engineer
Exam format
50–60 single-answer and multiple-select questions (standard exam)
Exam duration
120 minutes
Official exam languages
English, Japanese

Official exam languages and practice-question file languages are listed separately. Confirm the exam version and available languages when booking with the provider.

Official sources: Provider reference
Information checked: 2026-10-20

Supported languages

  • English
  • Simplified Chinese
  • Japanese
Try before you buy

First 20 practice questions

316 total questions

Questions follow the source order. Expand each answer to see its explanation.

Disclaimer: All questions on ExamPico are compiled from internet sources and are provided for study reference only.

Question 16

Question#16Topic1

You have ordered Dedicated Interconnect in the GCP Console and need to give the Letter of Authorization/Connecting Facility Assignment (LOA-CFA) to your cross-connect provider to complete the physical connection.
Which two actions can accomplish this? (Choose two.)

  1. A. Open a Cloud Support ticket under the Cloud Interconnect category.
  2. B. Download the LOA-CFA from the Hybrid Connectivity section of the GCP Console.
  3. C. Run gcloud compute interconnects describe <interconnect>.
  4. D. Check the email for the account of the NOC contact that you specified during the ordering process.
  5. E. Contact your cross-connect provider and inform them that Google automatically sent the LOA/CFA to them via email, and to complete the connection.
Show answer and explanation

Answer

BD

Explanation

After you order an interconnect, Google sends you and the NOC (technical contact) an email with your LOA-CFAs (one PDF file per interconnect). You must send these LOA-CFAs to your vendor so that they can install your cross connects. If you don't, your interconnects won't get connected. https://cloud.google.com/network-connectivity/docs/interconnect/how-to/dedicated/retrieving-loas

Question 17

Question#17Topic1

Your company offers a popular gaming service. Your instances are deployed with private IP addresses, and external access is granted through a global load balancer. You believe you have identified a potential malicious actor, but aren't certain you have the correct client IP address. You want to identify this actor while minimizing disruption to your legitimate users.
What should you do?

  1. A. Create a Cloud Armor Policy rule that denies traffic and review necessary logs.
  2. B. Create a Cloud Armor Policy rule that denies traffic, enable preview mode, and review necessary logs.
  3. C. Create a VPC Firewall rule that denies traffic, enable logging and set enforcement to disabled, and review necessary logs.
  4. D. Create a VPC Firewall rule that denies traffic, enable logging and set enforcement to enabled, and review necessary logs.
Show answer and explanation

Answer

B

Explanation

It says you "believe" you have a bad actor, and want to confirm this "while minimizing disruption to your legitimate users." [A] would block the traffic suspected IP, causing disruption to a legitimate user if you were wrong about the actor [B] Correct - You can log the requests by Client IP, and Preview Mode will not cause disruption to anyone, while you investigate. [C] Global Load balancers are Proxies, as Jordi says. This could work for Network load balancers, which are not proxies, but they are regional and not global. [D] As above, even if you could block from an NLB, it would cause disruption to someone.

Question 18

Question#18Topic1

Your company's web server administrator is migrating on-premises backend servers for an application to GCP. Libraries and configurations differ significantly across these backend servers. The migration to GCP will be lift-and-shift, and all requests to the servers will be served by a single network load balancer frontend.
You want to use a GCP-native solution when possible.
How should you deploy this service in GCP?

  1. A. Create a managed instance group from one of the images of the on-premises servers, and link this instance group to a target pool behind your load balancer.
  2. B. Create a target pool, add all backend instances to this target pool, and deploy the target pool behind your load balancer.
  3. C. Deploy a third-party virtual appliance as frontend to these servers that will accommodate the significant differences between these backend servers.
  4. D. Use GCP's ECMP capability to load-balance traffic to the backend servers by installing multiple equal-priority static routes to the backend servers.
Show answer and explanation

Answer

B

Explanation

Reference:
https://cloud.google.com/compute/docs/instance-groups/adding-an-instance-group-to-a-load-balancer

Question 19

Question#19Topic1

You decide to set up Cloud NAT. After completing the configuration, you find that one of your instances is not using the Cloud NAT for outbound NAT.
What is the most likely cause of this problem?

  1. A. The instance has been configured with multiple interfaces.
  2. B. An external IP address has been configured on the instance.
  3. C. You have created static routes that use RFC1918 ranges.
  4. D. The instance is accessible by a load balancer external IP address.
Show answer and explanation

Answer

B

Explanation

Reference:
https://www.sovereignsolutionscorp.com/google-cloud-nat/

Question 20

Question#20Topic1

You want to set up two Cloud Routers so that one has an active Border Gateway Protocol (BGP) session, and the other one acts as a standby.
Which BGP attribute should you use on your on-premises router?

  1. A. AS-Path
  2. B. Community
  3. C. Local Preference
  4. D. Multi-exit Discriminator
Show answer and explanation

Answer

D

Explanation

Reference:
https://cloud.google.com/router/docs/concepts/overview

Downloads and personal use

  • Purchase this exam question set separately with 1, 3, 6 or 12 months of download access.
  • After payment confirmation, your library shows the download link and exact expiry time.
  • Download again during your term. Purchase a new term after expiry.
  • PDFs are licensed for personal study only and must not be resold or shared publicly.
  • Files already saved to your device are not remotely deleted when access expires.
How to choose your certification