GCP PCNE study guide · 2026

The 6 GCP PCNE domains, explained

6 domains and 22 official objectives. Designing and planning a Google Cloud VPC network carries the most weight at ~21%. Each guide explains what the domain covers, how its questions are framed and where candidates lose marks.

Start with Domain 1 See all domains
Questions
50–60
Time
2 hours
Passing score
Not published by Google
Outline
Professional Cloud Network Engineer exam guide, current six-section version (PDF file 042426, linked from the certification page Oct 2026)

Exam blueprint

Bar widths follow the official weights. Weight ranges are drawn at their midpoint.

  1. 1 21%
  2. 2 20%
  3. 3 16%
  4. 4 16%
  5. 5 14%
  6. 6 13%
  1. 1 Designing and planning a Google Cloud VPC network
  2. 2 Implementing a VPC network
  3. 3 Configuring managed network services
  4. 4 Configuring and implementing hybrid and multicloud network interconnectivity
  5. 5 Managing, monitoring, and troubleshooting network operations
  6. 6 Configuring, implementing and managing a cloud network security solution

All 6 domains

22 official objectives 76–94 hrs suggested study

  1. Domain 01 ~21%

    Designing and planning a Google Cloud VPC network

    Section 1 is the largest part of the exam. It tests whether you can plan a Google Cloud network before anything is built: VPC count and type, IP ranges, hybrid paths, private service access, MTU and GKE addressing.

    Inside this domain

    • Designing an overall network architecture
    • Designing VPC networks
    • Designing a resilient and performant hybrid and multi-cloud network
    • Designing for Google Kubernetes Engine (GKE)

    Watch for Peering for central control

    Objectives
    4
    Questions est.
    ~11–12
    Study time est.
    16–20 hrs
  2. Domain 02 ~20%

    Implementing a VPC network

    Section 2 turns designs into working networks: creating VPCs and subnets, Shared VPC and peering, Private Google Access, VPC Service Controls, static and dynamic routes, Network Connectivity Center spokes and GKE cluster networking.

    Inside this domain

    • Configuring VPCs
    • Configuring VPC routing
    • Configuring Network Connectivity Center
    • Configuring and maintaining GKE clusters

    Watch for Shrink the subnet

    Objectives
    4
    Questions est.
    ~10–12
    Study time est.
    16–20 hrs
  3. Domain 03 ~16%

    Configuring managed network services

    Section 3 covers the managed services that deliver applications: picking and building the right load balancer, tuning backends, caching with Cloud CDN, and running public, private and hybrid DNS with Cloud DNS.

    Inside this domain

    • Configuring load balancing
    • Configuring Cloud CDN
    • Configuring Cloud DNS

    Watch for External load balancer for internal clients

    Objectives
    3
    Questions est.
    ~8–9
    Study time est.
    12–15 hrs
  4. Domain 04 ~16%

    Configuring and implementing hybrid and multicloud network interconnectivity

    Section 4 is about building the links to on-premises sites and other clouds: Interconnect circuits and VLAN attachments, HA VPN and Classic VPN tunnels, Cloud Router BGP sessions, and Network Connectivity Center hybrid and router appliance spokes.

    Inside this domain

    • Configuring Cloud Interconnect
    • Configuring a site-to-site IPSec VPN
    • Configuring Cloud Router
    • Configuring Network Connectivity Center

    Watch for Partner Interconnect for another cloud

    Objectives
    4
    Questions est.
    ~8–9
    Study time est.
    12–15 hrs
  5. Domain 05 ~14%

    Managing, monitoring, and troubleshooting network operations

    Section 5 tests day-two operations: reading network logs and metrics in Google Cloud Observability, draining traffic, fixing VPN, Interconnect and BGP problems, and using Network Intelligence Center to find misconfigurations.

    Inside this domain

    • Logging and monitoring with Google Cloud Observability
    • Maintaining and troubleshooting connectivity issues
    • Using Network Intelligence Center to monitor and troubleshoot common networking issues

    Watch for Capture everything

    Objectives
    3
    Questions est.
    ~7–8
    Study time est.
    10–12 hrs
  6. Domain 06 ~13%

    Configuring, implementing and managing a cloud network security solution

    Section 6 covers protecting Google Cloud networks: Cloud Armor at the edge, Cloud NGFW policies and VPC firewall rules inside the network, controlled internet egress with Cloud NAT and Secure Web Proxy, and third-party inspection appliances.

    Inside this domain

    • Configuring Google Cloud Armor policies
    • Configuring and managing NGFW policies and VPC firewall rules
    • Configuring and securing internet egress traffic using Public Cloud NAT and Secure Web Proxy
    • Configuring self-managed network virtual appliance and Packet Mirroring

    Watch for Firewall rule for web attacks

    Objectives
    4
    Questions est.
    ~6–8
    Study time est.
    10–12 hrs

Study the heaviest domains first

Marks follow weight. This order puts the most marks behind you first, across about 76–94 hrs of study.

  1. 1 Designing and planning a Google Cloud VPC network ~21% · 16–20 hrs
  2. 2 Implementing a VPC network ~20% · 16–20 hrs
  3. 3 Configuring managed network services ~16% · 12–15 hrs
  4. 4 Configuring and implementing hybrid and multicloud network interconnectivity ~16% · 12–15 hrs
  5. 5 Managing, monitoring, and troubleshooting network operations ~14% · 10–12 hrs
  6. 6 Configuring, implementing and managing a cloud network security solution ~13% · 10–12 hrs

Try one

Practice questionDomain 1: Designing and planning a Google Cloud VPC network

Your company runs workloads in two Google Cloud regions and connects its data center with Dedicated Interconnect in both regions. During a test, losing the Interconnect in one region cuts on-premises access to VMs in that region, even though the other region's link is healthy. What should you change?

One trap from every domain

The answer that looks right, and the clue that gives it away.

  • Domain 1

    Peering for central control

    Clue A central networking team must administer everything.

  • Domain 2

    Shrink the subnet

    Clue A request to reuse part of an existing range.

  • Domain 3

    External load balancer for internal clients

    Clue Callers are VMs or on-premises hosts using private IPs.

  • Domain 4

    Partner Interconnect for another cloud

    Clue The other end is a major public cloud, not a data center.

  • Domain 5

    Capture everything

    Clue A simple reachability failure between two known endpoints.

  • Domain 6

    Firewall rule for web attacks

    Clue Attack described in terms of request parameters or headers.

Other Networking certifications

Study guides for exams that overlap with GCP PCNE.

Practise what you read

GCP PCNE domains: common questions

How many domains are in the GCP PCNE exam?

GCP PCNE has 6 domains with 22 official objectives between them: Designing and planning a Google Cloud VPC network, Implementing a VPC network, Configuring managed network services, Configuring and implementing hybrid and multicloud network interconnectivity, Managing, monitoring, and troubleshooting network operations and Configuring, implementing and managing a cloud network security solution.

Which GCP PCNE domain carries the most weight?

Designing and planning a Google Cloud VPC network is the heaviest at ~21%, followed by Implementing a VPC network (~20%). The lightest is Configuring, implementing and managing a cloud network security solution (~13%). Weights come from Google Cloud's official outline.

What is the GCP PCNE exam format?

Questions: 50–60. Time allowed: 2 hours. Passing score: Not published by Google.

How long should I study for GCP PCNE?

Our planning estimate is 76–94 hrs across all domains, split by weight. It is an editorial estimate, not an official figure, so adjust it to your experience and to how you score on practice questions.

Where should I start?

Start with Designing and planning a Google Cloud VPC network, because it carries the most marks, then work down by weight. Use the checklist on each domain page to confirm you can do what the domain asks before moving on.

Which outline is this guide based on?

This guide follows Professional Cloud Network Engineer exam guide, current six-section version (PDF file 042426, linked from the certification page Oct 2026), published by Google Cloud. It was last reviewed in October 2026.

Domain names, weights and objectives come from Google Cloud's official outline (Professional Cloud Network Engineer exam guide, current six-section version (PDF file 042426, linked from the certification page Oct 2026)). Question counts and study hours are editorial planning estimates, not official figures. Last reviewed October 2026.