Why Study with PlanetCert?
The Latest Questions
Practice questions and exam topics aligned with the current exam objectives.
Detailed Explanations
Go beyond the answer. Master the material with comprehensive learning and professional explanations for every concept.
AI-Powered Insights
Personalized preparation guidance that adapts to your performance and identifies weak spots automatically.
Exam Information
Official specifications published by Google
Exam Format
120 min
50-60
Pass/Fail (approximately 70%)
Professional
Registration
$200 USD
Kryterion (onsite), Online Proctored, or online proctoring
English, Japanese
Validity
2 years
Take the renewal exam during the 60-day renewal eligibility period before expiration; Retake the standard exam at full price if more than 30 days past expiration; 50% discount code provided upon initial certification for renewal
GCP-PCNE Exam Topics and Domains
GCP-PCNE is organized into 6 weighted domains. Expect to work with VPC, Google Kubernetes Engine, Cloud DNS, Cloud Interconnect, and more.
1
Designing and Planning a Google Cloud Virtual Private Cloud (VPC) Network
24%
Designing an overall network architecture
High availability, failover, disaster recovery, and scale designDNS topology designLoad balancer selection for applicationsHybrid connectivity designGKE networking planningIAM roles in Shared VPC environmentsConnectivity to managed servicesNetwork tier differentiation
- Design network architectures for high availability, failover, disaster recovery, and scale
- Design the DNS topology for hybrid and cloud environments
- Choose the appropriate load balancer for an application or solution
- Design for hybrid connectivity including Private Google Access
- Plan for GKE networking including secondary ranges and IP address space
- Plan IAM roles including Shared VPC environments
- Plan for connectivity to managed services using Private Service Connect, private services access, and Serverless VPC Access
- Differentiate between network tiers (Premium and Standard)
Designing VPC networks
VPC type and quantity selectionNetwork interconnection designIP address management strategyGlobal and regional network environment planningMTU sizing for VPC workloadsThird-party device insertion
- Choose the correct VPC type and quantity for requirements
- Determine how networks interconnect based on requirements
- Plan IP address management strategy including IPv6 and BYOIP
- Plan global and regional network environments
- Determine correct MTU sizing for VPC workloads
- Plan third-party device insertion with custom routes and load balancing
Designing a resilient and performant hybrid and multi-cloud network
Hybrid connectivity designMulti-cloud connectivity designDirect Peering and Verified Peering ProviderHA and DR connectivity strategiesAccessing multiple VPCs from on-premisesPrivate access to Google services from on-premisesManaged services access through PSC and peeringIP address space design across environmentsDNS peering and forwarding strategyMTU sizing for hybrid connectionsInterconnect encryption options
- Design for hybrid connectivity including bandwidth and security constraints
- Design for multi-cloud connectivity using Cross-Cloud Interconnect and VPN
- Choose when to use Direct Peering or Verified Peering Provider
- Design HA and DR connectivity strategies for multiple regions
- Access multiple VPCs from on-premises locations
- Access Google services privately from on-premises locations
- Access managed services through PSC or VPC Network Peering
- Design IP address space across on-premises and cloud environments
- Design DNS peering and forwarding strategy
- Determine correct MTU sizing for hybrid connections
- Understand interconnect encryption options
Designing for Google Kubernetes Engine (GKE)
Public vs private cluster nodes and node poolsPublic vs private control plane endpointsSubnet planning: primary and secondary rangesIP address selection for GKEIPv6 planning for GKELoad balancing for GKE networkingNode pool configuration management
- Choose between public or private cluster nodes and node pools
- Choose between public or private control plane endpoints
- Plan subnets including primary and secondary ranges
- Select appropriate IP address types (RFC 1918, non-RFC 1918, PUPI)
- Plan for IPv6 in GKE
- Design load balancing for GKE networking
- Add and manage node pool configuration
2
Implementing a VPC Network
19%
Configuring VPCs
Creating Google Cloud VPC resourcesVPC Network Peering configurationShared VPC network creation and subnet sharingAccess to Google APIs and managed servicesAccess to Vertex AI servicesExpanding VPC subnet rangesVPC Service Controls perimeters
- Create Google Cloud VPC resources including networks, subnets, and firewall rules
- Configure VPC Network Peering
- Create Shared VPC and share subnets with other projects
- Configure access to Google APIs and Google-managed services
- Configure access to Vertex AI services
- Expand VPC subnet ranges after creation
- Configure VPC Service Controls perimeters
Configuring VPC routing
Static and dynamic routing setupGlobal or regional dynamic routingRouting with network tags and priorityRoute priorities with global dynamic routingInternal load balancer as next hopCustom route import/export over VPC Network PeeringPolicy-based Routing
- Set up static and dynamic routing
- Configure global or regional dynamic routing
- Implement routing using network tags and priority
- Design route priorities with global dynamic routing
- Implement an internal load balancer as a next hop
- Configure custom route import/export over VPC Network Peering
- Configure Policy-based Routing
Configuring Network Connectivity Center
Spoke types differentiationVPC topology managementPrivate NAT and PSC propagationIP/CIDR range filters for NCC spokesNCC monitoring and troubleshooting
- Differentiate between spoke types (VPC, Hybrid, Producer)
- Manage VPC topology using star, hub-and-spoke, and mesh patterns
- Configure Private NAT and Private Service Connect propagation
- Configure IP/CIDR range filters for NCC spokes
- Monitor and troubleshoot NCC
Configuring and maintaining Google Kubernetes Engine clusters
VPC-native clusters using alias IPsClusters with Shared VPCPrivate clusters and control plane endpointsGKE Dataplane V2Source NAT and IP Masquerade policiesGKE network policiesPod and service ranges
- Create VPC-native clusters using alias IPs
- Set up GKE clusters with Shared VPC
- Configure private clusters and private control plane endpoints
- Add authorized networks for cluster control plane
- Enable GKE Dataplane V2
- Configure SNAT and IP Masquerade policies
- Create GKE network policies
- Configure Pod ranges and service ranges
- Deploy additional Pod ranges for GKE clusters
3
Configuring Managed Network Services
16%
Configuring load balancing
Load balancing solution determinationBackend services configurationLoad balancer and backend settingsTraffic scalability optimizationLoad balancers in GKETraffic management on Application Load Balancers
- Determine the load balancing solution for a network
- Configure backend services including NEGs and MIGs
- Configure load balancers with appropriate settings
- Optimize for traffic scalability
- Understand load balancers in GKE
- Set up traffic management on Application Load Balancers
Configuring Cloud CDN
Cloud CDN for supported originsCloud CDN for external backendsCache invalidationSigned URLs
- Set up Cloud CDN for supported origins
- Set up Cloud CDN for external backends and third-party storage
- Invalidate cached content
- Configure signed URLs
Configuring Cloud DNS
Cloud DNS zones and records managementDNS migration to Cloud DNSCloud DNS routing policiesDNS Security Extensions (DNSSEC)Self-hosted DNS integrationDNS private and public zonesDNS cross-project binding and peeringCloud DNS and external-DNS for GKE
- Manage Cloud DNS zones and records
- Migrate to Cloud DNS
- Configure Cloud DNS routing policies
- Enable DNS Security Extensions (DNSSEC)
- Set up self-hosted DNS integration with Cloud DNS
- Understand DNS private and public zones and split-horizon DNS
- Set up DNS cross-project binding and DNS peering
- Configure Cloud DNS and external-DNS for GKE
4
Configuring and Implementing Hybrid and Multi-Cloud Network Interconnectivity
15%
Configuring Cloud Interconnect
Dedicated Interconnect connections and VLAN attachmentsPartner Interconnect connectionsCross-Cloud Interconnect connectionsHA VPN over Cloud InterconnectInterconnect SLA topologies
- Create Dedicated Interconnect connections and configure VLAN attachments
- Create Partner Interconnect connections and differentiate between Layer 2 and Layer 3
- Create Cross-Cloud Interconnect connections
- Configure HA VPN over Cloud Interconnect
- Implement 99.9% and 99.99% SLA Interconnect topologies
Configuring a site-to-site IPSec VPN
HA VPN to on-premises gatewaysHA VPN to other Google Cloud VPCsClassic VPN configuration
- Configure HA VPN towards on-premises VPN gateways
- Configure HA VPN towards other Google Cloud VPCs
- Configure Classic VPN including route-based and policy-based
Configuring Cloud Router
BGP attributes implementationBidirectional Forwarding Detection (BFD)Custom advertised and learned routesBest path selection
- Implement BGP attributes including ASN, route priority, and authentication
- Configure Bidirectional Forwarding Detection (BFD)
- Create custom advertised and custom learned routes
- Select between legacy and standard best path selection
Configuring Network Connectivity Center (Hybrid)
Hybrid spokes creationSite-to-site data transferRouter appliancesTransitivity networking issues
- Create hybrid spokes (VPN, VLAN attachment)
- Establish site-to-site data transfer
- Create Router appliances
- Solve common transitivity networking issues
5
Managing, Monitoring, and Troubleshooting Network Operations
12%
Logging and monitoring with Google Cloud Observability
Cloud Logging for networking componentsMonitoring networking metrics
- Enable and review Cloud Logging for networking components
- Monitor networking metrics across various Google Cloud services
Maintaining and troubleshooting connectivity issues
Traffic flow management with Application Load BalancersVPN troubleshootingCloud Interconnect troubleshootingCloud Router BGP peering troubleshootingTroubleshooting with VPC Flow Logs, firewall logs, and Packet Mirroring
- Drain and redirect traffic flows with Application Load Balancers
- Manage and troubleshoot VPNs
- Manage and troubleshoot Cloud Interconnect issues
- Troubleshoot Cloud Router BGP peering issues
- Troubleshoot with VPC Flow Logs, firewall logs, and Packet Mirroring
Using Network Intelligence Center
Network Topology visualizationConnectivity TestsPerformance DashboardFirewall InsightsNetwork AnalyzerFlow Analyzer and VPC Flow Logs
- Use Network Topology to visualize throughput and traffic flows
- Use Connectivity Tests to diagnose misconfigurations
- Use Performance Dashboard to identify packet loss and latency
- Use Firewall Insights to monitor rule hit count and identify shadowed rules
- Use Network Analyzer to identify failures and suboptimal configurations
- Use Flow Analyzer and VPC Flow Logs to evaluate network traffic
6
Configuring, Implementing and Managing a Cloud Network Security Solution
14%
Configuring Google Cloud Armor policies
Edge and backend security policiesWAF rules implementationAdvanced DDoS and Adaptive ProtectionRate limitingBot managementGoogle Threat Intelligence
- Configure and attach edge and backend security policies
- Implement WAF rules for SQL injection, XSS, and RFI
- Configure advanced DDoS and Adaptive Protection
- Configure rate limiting
- Configure bot management
- Apply Google Threat Intelligence
Configuring and managing Cloud NGFW policies and VPC Firewall rules
Firewall strategy planningCloud NGFW for GKE and load balancersVPC Firewall rules and NGFW policiesLayer 7 packet inspectionMigration from VPC Firewall rules to Cloud NGFWVPC and NGFW rule criteriaMicro-segmentationCloud NGFW tiers
- Plan the firewall strategy
- Configure Cloud NGFW to support GKE and load balancers
- Create and troubleshoot VPC Firewall rules and NGFW policies
- Enable Layer 7 inspection with Cloud NGFW Enterprise
- Migrate from VPC Firewall rules to Cloud NGFW policies
- Configure VPC and NGFW rule criteria and logging
- Incorporate micro-segmentation using metadata, Tags, and service accounts
- Differentiate between Cloud NGFW tiers: Essentials, Standard, and Enterprise
Configuring internet egress traffic using Cloud NAT and Secure Web Proxy
Public Cloud NAT IP addressingStatic and dynamic port allocationSecure Web Proxy configuration
- Configure public Cloud NAT IP addressing with automatic and manual allocation
- Configure static and dynamic port allocation for Cloud NAT
- Configure Secure Web Proxy
Configuring self-managed network packet inspection, IDS, and Packet Mirroring
Inter-VPC traffic inspection with multi-NIC VMsInternal load balancer as next hop for multi-NIC VMsPolicy-based routes for multi-NIC VM routingNetwork Security Integration (NSI)Cloud Intrusion Detection System (IDS)Packet Mirroring
- Route and inspect inter-VPC traffic using multi-NIC VMs
- Configure an internal load balancer as next hop for HA multi-NIC VM routing
- Configure policy-based routes for HA multi-NIC VM routing
- Develop a strategy for out-of-band Network Security Integration
- Configure Cloud Intrusion Detection System (IDS)
- Configure Packet Mirroring for VPC traffic towards self-managed collectors
How do I earn this certification?
Passing GCP-PCNE earns the Google Cloud Certified - Professional Cloud Network Engineer certification. It sits in the Networking track.
Next Level Options
- GCP-PCA - Professional Cloud ArchitectBroader solution architecture that builds on networking foundation
- GCP-PCSE - Professional Cloud Security EngineerDeeper security focus that extends network security knowledge
Alternative Paths
- GCP-PDE - Professional Data EngineerFor engineers interested in data pipeline networking and data infrastructure
- GCP-PMLE - Professional Machine Learning EngineerFor engineers interested in ML infrastructure and Vertex AI networking
Practice with Precision
The PlanetCert Simulator mirrors the real exam environment with authentic questions and timed pressure.
How to study for this exam?
The most effective way to prepare for GCP-PCNE is by using the PlanetCert Simulator to practice questions and review detailed explanations.
Who should take this exam?
- 3+ years of industry experience including 1+ years designing and managing solutions using Google Cloud
- Understanding of networking concepts including the OSI 7-layer model
- Experience with IPv4 addressing, managing IPv4 routes and firewall rules
- Experience with load balancers
- Basic proficiency with command-line tools and Linux operating system environments