Home
Google Cloud
PCNE
Syllabus

PCNE syllabus

5 domains and 143 topics, updated November 2026

Overview Syllabus Notes Patterns Revision Sample questions Practise

The Professional Cloud Network Engineer exam tests how you design, build and run Google Cloud networks: VPCs, hybrid links, load balancing, DNS and routing, and security and operations. This outline lists what each domain expects, in plain terms. Tick topics off as you cover them. Your ticks are saved in this browser.

This outline follows the official PCNE exam guide (PDF). Check it for the exact wording.

Designing and planning VPC networks

Designing the overall network, choosing VPC types and address plans, reaching managed services, and planning and building GKE networking. Together with the routing and NCC topics it makes up the biggest share of the exam.

Overall network architecture

Premium and Standard network tiers and what each one changes
Designing for high availability, failover, disaster recovery and scale across zones and regions
Choosing a load balancer to fit the design
Planning DNS topology between on-premises and Cloud DNS
Quotas and limits to plan for: subnets, routes, forwarding rules, peering groups, Cloud Router prefixes

IAM roles for network designs

Shared VPC Admin, Compute Network User at project or subnet level, Host Service Agent User for GKE
Compute Network Admin and Security Admin split between network and security teams
Load Balancer Admin and Load Balancer Services User for load balancer provisioning

VPC type, count and interconnection

Standalone VPC, Shared VPC, or several VPCs, and how many environments
VPC Network Peering: rules, non-transitivity, custom route exchange, quotas
Mesh and star connectivity with Network Connectivity Center
Private Service Connect for service-level connectivity
Global versus regional network environments
Third-party appliances in the path: multi-NIC VMs, custom routes, internal load balancer next hop, policy-based routes

IP address management

Subnet sizing, reserved addresses, expanding ranges, auto mode versus custom mode
IPv6: dual-stack, IPv6-only, ULA and external ranges
Bring your own IP, privately used public IPs, non-RFC 1918 ranges, Private NAT
Internal ranges and automating IPAM
Avoiding overlaps across on-premises, cloud and managed services

MTU

Default VPC MTU and the allowed range
MTU for VLAN attachments and HA VPN, and symptoms of a mismatch

Reaching managed services and Google APIs

Private services access: allocated range and peering
Private Service Connect endpoints, backends, service attachments and interfaces
Serverless VPC Access connectors and Direct VPC egress
Private Google Access and public interfaces
Private access from on-premises to Google APIs, including AI services

Building VPC resources

Networks, subnets, proxy-only and PSC NAT subnets, private services access subnet
Peering configuration and Shared VPC sharing of subnets
Permissions for service projects to use shared subnets
Expanding subnet ranges after creation

GKE network design

Public or private nodes and node pools
Public, private or DNS-based control plane endpoints and authorized networks
Primary and secondary ranges, Pod and Service range sizing, scale limits
IP address choices: RFC 1918, non-RFC 1918, PSC, PUPI, Google-managed ranges
IPv6 in GKE
Load balancing design for GKE

GKE configuration

VPC-native clusters with alias IPs and Shared VPC clusters
Private clusters and private control plane endpoints, control plane global access
Dataplane V2 and Kubernetes network policies
SNAT and IP masquerade policies
Additional Pod ranges and node pool configuration
DNS options: kube-dns, NodeLocal DNSCache, Cloud DNS for GKE

Read the notes Practise this domain

Configuring hybrid connectivity

Dedicated, Partner and Cross-Cloud Interconnect, HA VPN, Cloud Router and BGP, peering options and the hybrid spokes of Network Connectivity Center, plus troubleshooting of these links.

Choosing and designing hybrid links

Bandwidth, security and location constraints for Interconnect, Cloud VPN and SD-WAN
Multicloud connectivity with Cloud VPN and Cross-Cloud Interconnect
Direct Peering versus Verified Peering Provider, and what they do not give you
High availability and DR across regions with regional or global dynamic routing
Reaching several VPCs from on-premises
Private access to Google APIs and AI services from on-premises
Avoiding IP overlap with on-premises and using Private NAT
Interconnect encryption: MACsec versus HA VPN over Interconnect
MTU for Interconnect and VPN

Cloud Interconnect

Dedicated Interconnect: LOA-CFA, circuits, VLAN attachments
Partner Interconnect: pairing key, layer 2 versus layer 3 partners
Cross-Cloud Interconnect
HA VPN over Cloud Interconnect
Topologies that reach 99.9% and 99.99% SLAs

Site-to-site IPsec VPN

HA VPN to an on-premises gateway, peer gateway redundancy types
HA VPN between two Google Cloud VPCs
Classic VPN: route-based, policy-based, and why it is deprecated

Cloud Router and BGP

ASN, link-local addresses, MED and route priority, MD5 authentication
BFD and BGP timers
Default and custom advertised routes; custom learned routes
Legacy versus standard best path selection

Network Connectivity Center for hybrid

Hybrid spokes from VPN tunnels and VLAN attachments
Site-to-site data transfer over Google's backbone
Router appliance spokes and BGP to appliances
Solving transitivity problems

Troubleshooting hybrid connectivity

VPN: IKE, keys, traffic selectors, status and logs
Interconnect: light levels, LACP, attachment states, metrics
Cloud Router BGP session states, learned and advertised routes

Read the notes Practise this domain

Load balancing

Picking the right load balancer, configuring backends and traffic management, GKE load balancing, draining traffic, and Cloud CDN.

Choosing a load balancer

Internal or external, global or regional
Application (layer 7), proxy Network and passthrough Network load balancers
Client IP preservation, UDP and protocol support
Proxy-only subnets and required firewall rules

Backends and capacity

Managed instance groups, unmanaged groups and autoscaling
Zonal, serverless, internet, hybrid and PSC NEGs; backend buckets
Balancing modes, capacity scaler, spillover
Health checks and their probe ranges
Session affinity options and global access

Application load balancer traffic management

URL maps, host and path rules, route rules
Traffic splitting, mirroring, URL rewrites, redirects, header transformations
Certificates, SSL policies, HTTPS redirect

GKE load balancing

Gateway controller, Ingress controller, Service type LoadBalancer
Container-native load balancing with NEGs, standalone NEGs

Draining and redirecting traffic

Connection draining, capacity scaler 0, weighted backends

Cloud CDN

Origins: instance groups, Cloud Storage buckets, Cloud Run, serverless NEGs
External origins and third-party object storage with internet NEGs
Cache modes, TTLs, cache keys, signed URLs
Invalidating cached content

Read the notes Practise this domain

Cloud DNS and routing

Cloud DNS zones, policies and hybrid DNS, VPC routes and route selection, policy-based routing, route exchange over peering, and Network Connectivity Center configuration.

Cloud DNS zones and records

Public, private, forwarding, peering and reverse zones
Zone and record management, TTLs, delegation
Migrating a domain to Cloud DNS
DNSSEC and the DS record
Resolution order inside a VPC, response policies

DNS routing policies

Weighted round robin, geolocation, failover and trickle ratio
Health checks that drive failover

Hybrid and multi-project DNS

Outbound forwarding to on-premises and the 35.199.192.0/19 source range
Inbound server policies and entry points
DNS peering and cross-project binding
Split-horizon DNS with public and private zones
Self-hosted DNS integration and alternative name servers
Cloud DNS, kube-dns and ExternalDNS for GKE

VPC routes

System, custom static, dynamic, peering and subnet routes
Longest prefix, priority and ECMP
Network tags on routes
Global versus regional dynamic routing
Internal load balancer as next hop

Policy-based routing and route exchange

Policy-based route matching, priority and skip action
Custom route import and export over VPC Network Peering
Custom route handling in Network Connectivity Center

Network Connectivity Center

Spoke types: VPC, hybrid, router appliance, producer
Mesh and star topologies, center and edge groups
IP range include and exclude filters
Private NAT and PSC propagation
Monitoring and troubleshooting NCC

Read the notes Practise this domain

Network security

Cloud Armor, Cloud NGFW and VPC firewall rules, Cloud NAT, Secure Web Proxy, appliances and Packet Mirroring, VPC Service Controls, and the logging, monitoring and Network Intelligence Center tools used to run and troubleshoot networks.

Cloud Armor

Edge, backend and network edge security policies
WAF rules for SQL injection, XSS, file inclusion and sensitivity tuning
Network DDoS protection and Adaptive Protection
Rate limiting, bot management with reCAPTCHA
Google Threat Intelligence lists

Firewall rules and Cloud NGFW

Firewall strategy: VPC rules, NGFW policies, hierarchical policies, partner integration
Effective rules and evaluation order including goto_next
NGFW tiers: Essentials, Standard, Enterprise
Layer 7 inspection with firewall endpoints and TLS inspection
Rule criteria: priority, direction, protocols, source and destination, FQDN, geolocation
Micro-segmentation with secure tags, service accounts and network tags
Migrating from VPC firewall rules to policies
Firewall support for GKE and load balancers
Firewall rules logging

Internet egress

Cloud NAT IP allocation, automatic and manual
Static and dynamic port allocation, timeouts, exhaustion
Secure Web Proxy policies and TLS inspection

Appliances and mirroring

Multi-NIC NVAs, internal load balancer next hop, policy-based routes for HA
Out-of-band Network Security Integration
Packet Mirroring to self-managed collectors

VPC Service Controls

Perimeters, restricted services, access levels, ingress and egress rules
Dry-run mode and violation logs
Restricted and private Google API access

Logging and monitoring

Logs: VPC Flow Logs, firewall, NAT, DNS, VPN, Cloud Router, VPC-SC, NCC
Metrics for VPN, Interconnect, Cloud Router, load balancers, Cloud Armor, NAT

Network Intelligence Center

Network Topology, Connectivity Tests, Performance Dashboard
Firewall Insights, Network Analyzer, Flow Analyzer
Using these tools to troubleshoot connectivity, drops and misconfiguration

Read the notes Practise this domain