GOOGLE CLOUDGoogle Cloud Professional Cloud Network Engineer
The Google Cloud Professional Cloud Network Engineer certification validates your ability to design, implement, and manage secure, scalable network architectures on Google Cloud. It is intended for network engineers who architect hybrid and multi-cloud connectivity, configure network services, and optimize performance and reliability. Earning it demonstrates that you can translate business requirements into robust, production-ready network solutions.
502 practice questions · Updated 2026-07-30
6Domains
22Objectives
195Concepts
502Questions
PROFESSIONAL-CLOUD-NETWORK-ENGINEER Curriculum
Every domain, objective, and concept the PROFESSIONAL-CLOUD-NETWORK-ENGINEER exam measures.
- Network Tiers Overview
- Selecting Network Tiers
- High Availability Design
- Failover Strategies
- Disaster Recovery Planning
- Scaling Network Architecture
- DNS Topology Design
- Cloud DNS Configuration
- On-Premises DNS Integration
- Load Balancer Types
- Load Balancer Selection Criteria
- GKE Networking Fundamentals
- Secondary Ranges for GKE
- GKE Scale and IP Address Planning
- GKE Control Plane Access
- IAM Roles for Network Architecture
- Shared VPC Subnet Permissions
- Private Services Access
- Private Service Connect (PSC)
- Serverless VPC Access
- Quotas and Limits Planning
- Monitoring and Adjusting Quotas
- VPC Types and Quantity
- Network Interconnection Methods
- IP Address Management (IPAM) Strategy
- Global vs Regional Network Design
- MTU Sizing for VPC
- Third-Party Device Insertion
- Hybrid Connectivity Options
- Multicloud Connectivity
- Direct Peering vs. Verified Peering Provider
- High-Availability and Disaster Recovery Connectivity
- Accessing Multiple VPCs from On-Premises
- Private Access to Google Services
- Private Service Connect and VPC Peering for Managed Services
- IP Address Planning and Overlap Avoidance
- Hybrid DNS Topology
- MTU Sizing for Hybrid Connections
- Interconnect Encryption Options
- Public vs. Private GKE Cluster Nodes
- Public vs. Private Control Plane Endpoints
- Primary and Secondary Subnet Ranges for GKE
- GKE IP Address Planning with RFC 1918 and Non-RFC 1918
- Private Service Connect (PSC) and Shared IP Ranges in GKE
- Pod and Service IP Ranges (PUPI) Planning
- IPv6 Planning for GKE
- Designing Load Balancing for GKE
- Node Pool Configuration Management
- VPC network creation
- Subnet creation and management
- Firewall rules and policies
- Private services access subnet
- Private pools configuration
- VPC Network Peering setup
- Shared VPC creation
- Sharing subnets with service projects
- IAM permissions for Shared VPC subnets
- Private Google Access configuration
- Public interface configuration for Google APIs
- Expanding VPC subnet ranges
- VPC Service Controls perimeters
- Static vs. dynamic routing
- Cloud Router and BGP
- Global vs. regional dynamic routing
- Route creation with network tags
- Route priority and precedence
- Policy-based routing
- Internal load balancer as next hop
- Custom route import/export over VPC peering
- Custom route import/export over Network Connectivity Center
- VPC spoke
- Hybrid spoke
- Producer spoke
- Star topology
- Hub and spokes topology
- Mesh topology
- Private NAT configuration
- PSC propagation
- IP/CIDR range filters
- Monitoring Network Connectivity Center
- Troubleshooting Network Connectivity Center
- VPC-native clusters and alias IPs
- Shared VPC for GKE clusters
- Private clusters and private control plane endpoints
- Authorized networks for control plane endpoints
- DNS-based endpoint for control plane access
- GKE Dataplane V2
- Source NAT and IP Masquerade policies
- GKE network policies
- Pod ranges and service ranges
- Deploying additional Pod ranges
- DNS configuration in GKE
- Load balancer type selection
- Backend service configuration
- Load balancer settings
- GKE load balancing
- Application Load Balancer traffic management
- Cloud CDN overview
- Supported origins for Cloud CDN
- Setting up Cloud CDN for managed instance groups
- Setting up Cloud CDN for Cloud Storage buckets
- Setting up Cloud CDN for Cloud Run
- Setting up Cloud CDN for internet NEGs
- Setting up Cloud CDN for third-party object storage
- Invalidating cached content
- Cache invalidation best practices
- Cloud DNS zone types
- Managing DNS records
- Migrating DNS to Cloud DNS
- Cloud DNS routing policies
- Enabling DNSSEC
- DNS forwarding and server policies
- Split-horizon DNS
- Cross-project DNS binding and peering
- Cloud DNS with external-dns for GKE
- Dedicated Interconnect provisioning
- VLAN attachments for Dedicated Interconnect
- Partner Interconnect provisioning
- Layer 2 vs layer 3 Partner Interconnect
- Cross-Cloud Interconnect provisioning
- VLAN attachments for Cross-Cloud Interconnect
- HA VPN over Cloud Interconnect
- Interconnect SLA topologies
- HA VPN Overview
- HA VPN Configuration Steps
- HA VPN to On-Premise Gateways
- HA VPN to Other VPCs
- Classic VPN Overview
- Route-Based Classic VPN
- Policy-Based Classic VPN
- Troubleshooting VPN Connectivity
- BGP attributes
- BFD configuration
- Custom-advertised routes
- Custom-learned routes
- Legacy vs standard best path selection
- Hybrid Spoke Creation
- Site-to-Site Data Transfer
- Router Appliance Configuration
- Transitivity Issue Resolution
- Enable Cloud Logging for networking components
- Review Cloud Logging logs for networking components
- Monitor networking metrics for Cloud VPN
- Monitor networking metrics for Cloud Interconnect and VLAN attachments
- Monitor networking metrics for Cloud Router
- Monitor networking metrics for load balancers
- Monitor networking metrics for Google Cloud Armor
- Monitor networking metrics for Cloud NAT
- ALB connection draining
- ALB traffic redirection
- VPN troubleshooting fundamentals
- VPN tunnel monitoring and maintenance
- Cloud Interconnect troubleshooting
- Cloud Interconnect maintenance and monitoring
- Cloud Router BGP peering troubleshooting
- BGP route and policy verification
- VPC Flow Logs for connectivity troubleshooting
- Firewall logs for connectivity troubleshooting
- Packet Mirroring for deep packet analysis
- Network Topology visualization
- Connectivity Tests for route and firewall diagnostics
- Performance Dashboard analysis
- Firewall Insights usage
- Network Analyzer for network health
- Flow Analyzer and VPC Flow Logs analysis
- Edge and backend security policies
- WAF rules for common attacks
- Advanced network DDoS protection
- Rate limiting
- Bot management
- Google Threat Intelligence integration
- Firewall strategy planning
- Hierarchical firewall effective policy
- Cloud NGFW for GKE and Load Balancing
- VPC firewall rule creation and troubleshooting
- Cloud NGFW policy management
- Layer 7 inspection with Cloud NGFW Enterprise
- Migration from VPC firewall rules to Cloud NGFW
- Firewall rule criteria configuration
- Firewall logging configuration
- Micro-segmentation techniques
- Cloud NGFW tier differentiation
- Cloud NAT IP addressing
- Automatic vs manual NAT IP assignment
- Cloud NAT port allocation
- Static port allocation
- Dynamic port allocation
- Secure Web Proxy configuration
- Secure Web Proxy policies
- Integration of Cloud NAT and Secure Web Proxy
- Multi-NIC VM Routing for Inter-VPC Traffic
- Internal Load Balancer as Next Hop
- Policy-Based Routes for HA Multi-NIC VM Routing
- Out-of-Band Network Security Integration Strategy
- Packet Mirroring Configuration
Ready to practice?Test your knowledge with exam-style questions or take an intelligent quiz tailored to your level.
Percentages reflect share of the current practice bank, not official exam weightings — no structured per-skill weight is published for PROFESSIONAL-CLOUD-NETWORK-ENGINEER, so none is invented.