Google Cloud Professional Cloud Network Engineer tests whether you can design, build and run networks on Google Cloud: VPC design and IP planning, routing, load balancing, Cloud DNS, hybrid and multicloud connectivity with Cloud Interconnect, HA VPN and Network Connectivity Center, troubleshooting with Network Intelligence Center, and network security with Cloud NGFW, Cloud Armor, Secure Web Proxy and VPC Service Controls. The current exam guide went live on 24 April 2026. Google restructured it to be more focused and less repetitive.
This guide follows the official exam guide: six sections with weights, the services to tell apart, a 7-week plan and 15 original scenario questions.
Quick facts (Google Cloud, November 2026)
| Item | Detail |
|---|---|
| Length | 2 hours |
| Questions | 50–60, multiple choice and multiple select |
| Fee | USD 200 (plus tax where applicable) |
| Languages | English, Japanese |
| Delivery | Online-proctored or at a test centre |
| Prerequisites | None; 3+ years of industry experience including 1+ year designing and managing Google Cloud solutions recommended |
Read the official Professional Cloud Network Engineer page and exam guide before booking. Google also publishes free sample questions.
Who should take it?
- Network engineers (CCNA or CCNP background) moving to cloud.
- Cloud and DevOps engineers who own VPCs, load balancers, DNS and hybrid links.
- Security engineers working on firewalls, WAF and egress control. Pair it with the Professional Cloud Security Engineer.
Sections and weights
| Section | Weight |
|---|---|
| 1. Designing and planning a Google Cloud VPC network | ~21% |
| 2. Implementing a VPC network | ~20% |
| 3. Configuring managed network services | ~16% |
| 4. Configuring and implementing hybrid and multicloud interconnectivity | ~16% |
| 5. Managing, monitoring and troubleshooting network operations | ~14% |
| 6. Configuring, implementing and managing network security | ~13% |
Section 1: Design (~21%)
- Architecture: Premium vs Standard network tiers; HA, failover, DR and scale; DNS topology; choosing a load balancer; GKE networking; IAM for network roles; private services access, Private Service Connect and Serverless VPC Access; quotas.
- VPC design: standalone vs Shared VPC; VPC Network Peering, Network Connectivity Center (mesh and star) and PSC; IP address management (IPv6, BYOIP, privately used public IPs, Private NAT, non-RFC 1918); global vs regional; MTU; network virtual appliances with custom routes.
- Hybrid and multicloud: Dedicated and Partner Interconnect, Cloud VPN and SD-WAN; Cross-Cloud Interconnect; Direct Peering; regional vs global dynamic routing; reaching Vertex AI and Google APIs privately from on-premises; hybrid DNS (forwarding, inbound policies, DNS peering); MACsec and HA VPN over Interconnect.
- GKE: private nodes and control plane endpoints; primary and secondary ranges; IP planning; IPv6; load balancing; node pools.
Section 2: Implement (~20%)
- VPCs: networks, subnets and firewall policies; peering; Shared VPC and service-project IAM; Private Google Access; expanding subnets; VPC Service Controls perimeters.
- Routing: static and dynamic routes with Cloud Router; network tags and priority; policy-based routing; internal load balancer as next hop; custom route import and export.
- Network Connectivity Center: VPC, hybrid and producer spokes; star, hub-and-spoke and mesh; Private NAT and PSC propagation; range filters.
- GKE: VPC-native clusters with alias IPs; Shared VPC clusters; private clusters, authorised networks and DNS-based control plane endpoints; Dataplane V2; SNAT and IP masquerade; network policies; Pod and Service ranges; DNS (NodeLocal DNSCache, Cloud DNS, kube-dns).
Section 3: Managed services (~16%)
- Load balancing: internal vs external, regional vs global, application vs proxy vs passthrough; NEGs and MIGs; session affinity, URL maps, health checks; GKE Gateway and Ingress; traffic splitting, mirroring and URL rewrites.
- Cloud CDN: MIG, Cloud Storage and Cloud Run origins; internet NEGs; cache invalidation.
- Cloud DNS: zones and records; migration; geolocation and failover routing policies; DNSSEC; forwarding and server policies; split-horizon; cross-project binding and DNS peering; external-dns for GKE.
| Need | Usual load balancer |
|---|---|
| Global HTTPS website with URL routing and Cloud Armor | Global external Application Load Balancer |
| Internal HTTP microservices in one region | Regional internal Application Load Balancer |
| Non-HTTP TCP/UDP traffic, client IP preserved | Passthrough Network Load Balancer |
| Global TCP with SSL offload | Global external proxy Network Load Balancer |
| Next hop for a firewall appliance | Internal passthrough Network Load Balancer |
Section 4: Hybrid and multicloud (~16%)
- Cloud Interconnect: Dedicated, Partner (layer 2 vs layer 3) and Cross-Cloud Interconnect with VLAN attachments; HA VPN over Interconnect; topologies for 99.9% and 99.99% SLAs.
- VPN: HA VPN to on-premises and to other VPCs; Classic VPN (route-based and policy-based).
- Cloud Router: BGP ASN, MED and route priority, link-local addresses and authentication; BFD; custom advertised and learned routes; legacy vs standard best-path selection.
- NCC hybrid: VPN and VLAN spokes; site-to-site data transfer; router appliances; transitivity problems.
# HA VPN: two interfaces for the 99.99% SLA, BGP through Cloud Router
gcloud compute vpn-gateways create gw-hyd --network=prod-vpc --region=asia-south1
gcloud compute routers create cr-hyd --network=prod-vpc --region=asia-south1 --asn=65010
gcloud compute vpn-tunnels create t0 --vpn-gateway=gw-hyd --interface=0 \
--peer-external-gateway=onprem-gw --peer-external-gateway-interface=0 \
--router=cr-hyd --ike-version=2 --shared-secret="$PSK" --region=asia-south1
# Repeat for interface 1, then add a BGP peer on each tunnel's Cloud Router interfaceSection 5: Operations (~14%)
- Cloud Logging for VPN, Cloud Router, VPC Service Controls, Cloud NGFW, Firewall Insights, VPC Flow Logs, Cloud DNS, Cloud NAT and NCC; metrics for VPN, Interconnect, load balancers, Cloud Armor and Cloud NAT.
- Draining traffic; troubleshooting VPN, Interconnect and BGP peering; VPC Flow Logs, firewall logs and Packet Mirroring.
- Network Intelligence Center: Network Topology, Connectivity Tests, Performance Dashboard, Firewall Insights, Network Analyzer and Flow Analyzer.
Section 6: Security (~13%)
- Cloud Armor: edge and backend policies; WAF rules (SQL injection, XSS, remote file inclusion); DDoS and Adaptive Protection; rate limiting; bot management; Google Threat Intelligence.
- Firewalls: VPC firewall rules vs Cloud NGFW (Essentials, Standard, Enterprise) and hierarchical policies; effective rules; layer 7 inspection with NGFW Enterprise; migrating to NGFW policies; secure tags, service accounts and network tags for micro-segmentation; firewall logging.
- Egress: public Cloud NAT with automatic or manual IPs; static vs dynamic port allocation; Secure Web Proxy.
- Appliances: multi-NIC VMs for inspection; internal LB as next hop for HA; policy-based routes; Network Security Integration; Packet Mirroring.
7-week study plan
| Week | Focus | Lab |
|---|---|---|
| 1 | VPC basics, subnets, IP planning, firewall rules, routes, Private Google Access | Custom-mode VPC with two regions and tag-based rules |
| 2 | Shared VPC, peering, PSC, private services access, VPC Service Controls | Shared VPC with two service projects; PSC to Cloud SQL |
| 3 | Load balancers, NEGs, Cloud CDN, Cloud DNS policies, DNSSEC, split-horizon | Global ALB with CDN and a failover DNS policy |
| 4 | HA VPN, Cloud Router, BGP, BFD, Interconnect options and SLAs | HA VPN between two VPCs with BGP |
| 5 | Network Connectivity Center, GKE networking, Dataplane V2, network policies | Private VPC-native GKE cluster on a Shared VPC |
| 6 | Cloud NGFW, hierarchical policies, Cloud Armor, Cloud NAT, Secure Web Proxy | Cloud Armor WAF and rate limit in front of the ALB |
| 7 | Flow Logs, Packet Mirroring, Network Intelligence Center; sample questions | Use Connectivity Tests to find a blocked path; book the exam |
15 scenario questions with answers
These are original scenarios written for this guide, not exam questions.
1. A central team must own the network while app teams deploy in their own projects. What do you use?
Shared VPC.
2. Consumers in many VPCs need private access to one producer service, with overlapping IP ranges allowed. What do you use?
Private Service Connect.
3. Fifteen VPCs and on-premises sites need hub-and-spoke connectivity with transitive routing. What do you use?
Network Connectivity Center.
4. A subnet is running out of IP addresses. What can you do without recreating it?
Expand the subnet's primary range.
5. An on-premises data centre needs 99.99% availability to Google Cloud at 10 Gbps. What do you build?
Dedicated Interconnect with the 99.99% topology: redundant connections in two metros and two regions with Cloud Routers.
6. Your company has no colocation facility near Google. How do you get Interconnect?
Partner Interconnect through a service provider.
7. You need private connectivity from Google Cloud to another cloud provider. Which product?
Cross-Cloud Interconnect (or HA VPN for lower bandwidth).
8. BGP sessions take too long to detect a failed link. What do you enable?
Bidirectional Forwarding Detection (BFD) on Cloud Router.
9. VMs without external IPs must download OS updates from the internet. What do you configure?
Cloud NAT.
10. On-premises servers must resolve names in a Cloud DNS private zone. What do you configure?
An inbound DNS server policy, with on-premises DNS forwarding to its addresses.
11. A website is hit by SQL injection attempts and bot traffic. What do you attach to the load balancer?
A Cloud Armor security policy with WAF rules, rate limiting and bot management.
12. Firewall rules must be enforced across every project in a folder. What do you use?
A hierarchical firewall policy.
13. You need TLS inspection and intrusion prevention between workloads. Which tier?
Cloud NGFW Enterprise.
14. Data must not be copied out of BigQuery and Cloud Storage to outside projects, even by insiders with valid credentials. What helps?
A VPC Service Controls perimeter.
15. A VM can't reach a database and you suspect a firewall rule. What is the fastest check?
Run a Connectivity Test in Network Intelligence Center.
After Professional Cloud Network Engineer
- Practise GCP interview questions and AWS VPC and Azure networking interview questions.
- Read the Professional Cloud Architect guide and the Professional Cloud DevOps Engineer guide.
- See live cloud and network jobs.
Cloud Soft Solutions in Ameerpet, Hyderabad teaches Google Cloud, AWS and Azure networking, security and DevOps with real-time projects. See the APEX program and all courses.
📞 Call +91 96660 19191 · WhatsApp · Flat No. 513, 5th Floor, Nilagiri Block, Aditya Enclave, Ameerpet, Hyderabad
Frequently Asked Questions
How long is the Professional Cloud Network Engineer exam?
2 hours, with 50 to 60 multiple-choice and multiple-select questions.
How much does the exam cost?
USD 200, plus tax where applicable.
Which section has the most weight?
Designing and planning a Google Cloud VPC network, at about 21%.
When did the current exam guide start?
The restructured exam guide went live in English on 24 April 2026.
Is there a prerequisite?
No. Google recommends 3+ years of industry experience, including 1+ year designing and managing Google Cloud solutions.
Which languages is the exam offered in?
English and Japanese.
