Examkin

Question

Difficulty: HardManaging Networking Resources

A Cloud Operations engineer is configuring a new Regional Internal Application Load Balancer in a custom Virtual Private Cloud (VPC) network named `corp-vpc` in the `us-central1` region. The load balancer will distribute internal HTTP traffic across a Compute Engine managed instance group deployed in a workload subnet (`10.1.0.0/24`). Before deploying the backend service and forwarding rule, the engineer needs to establish the underlying networking infrastructure required by Google Cloud for proxy-based internal load balancing. Which TWO networking configuration steps must be performed to meet these requirements?

  1. Create a dedicated proxy-only subnet in `corp-vpc` for the `us-central1` region with the purpose set to REGIONAL_MANAGED_PROXY.Answer
  2. Create an ingress firewall rule in `corp-vpc` allowing traffic from the proxy-only subnet IP range to the backend Compute Engine instances on the application port.Answer
  3. C
    Enable Private Google Access on the primary workload subnet so Envoy proxies can establish internal connections with backend instances.
  4. D
    Deploy a Cloud NAT gateway in `us-central1` attached to the proxy-only subnet to route health check probes from Google Cloud back to the backend instances.

Answer

To operationalize a Regional Internal Application Load Balancer on GCP, you must create a proxy-only subnet with purpose REGIONAL_MANAGED_PROXY in the specified region and configure an ingress firewall rule allowing traffic from the proxy-only subnet range to the backend instances.
Regional Internal Application Load Balancers use an Envoy proxy architecture. Google Cloud requires a designated proxy-only subnet in the region (with purpose REGIONAL_MANAGED_PROXY) to host these proxies. Additionally, because connections to backend instances originate from the IP addresses in this proxy-only subnet, an ingress firewall rule allowing traffic from the proxy-only subnet CIDR to the backend VM instances is required.

Step-by-Step Solution

1
Identify the architectural requirements for GCP Envoy-based regional load balancers.
Regional Internal Application Load Balancers require a regional proxy-only subnet to allocate IP addresses for Envoy proxy instances.
Google Cloud manages Envoy proxies automatically inside the allocated proxy-only subnet for the region.
2
Configure the necessary network security controls for proxy-to-backend communication.
Create an ingress firewall rule permitting traffic originating from the proxy-only subnet CIDR to reach backend instances on the application port.
By default, VPC network firewalls block incoming connections unless explicitly allowed.

Key Concept

Regional Internal Application Load Balancers require a dedicated proxy-only subnet (REGIONAL_MANAGED_PROXY) per region and corresponding VPC ingress firewall rules to allow proxy traffic to reach backend virtual machines.
Estimated Time:2m 0s
Rate this question

Topics

Managing Networking Resources

More questions from this topic