Examkin

Question

Difficulty: HardPlanning Network Load Balancing, Cloud DNS, and Cloud CDN

A digital gaming company is designing the Google Cloud network architecture for a global multiplayer game backend hosted on Compute Engine instances. The platform architecture has two distinct requirements:
1. Incoming client connections from the public internet use a proprietary, non-HTTP raw TCP protocol, but require SSL/TLS termination at the Google network edge to offload encryption processing from backend instances.
2. Internal microservices running in a custom VPC network need to resolve internal service domain names under `game.internal` to private IP addresses without broadcasting DNS queries to the public internet.

Which TWO architectural components should the cloud engineering team plan and implement to satisfy these requirements? (Select TWO.)

  1. Provision a Global External SSL Proxy Load Balancer to terminate client TLS sessions at the edge and proxy the raw TCP traffic to the backend instances.Answer
  2. B
    Provision a Global External Application Load Balancer to terminate client TLS sessions at the edge and forward the raw TCP traffic to the backend instances.
  3. Create a Cloud DNS Private Zone configured for the domain `game.internal` and authorize access exclusively to the target VPC network.Answer
  4. D
    Create a Cloud DNS Public Zone configured for `game.internal` and use VPC Firewall Rules to block external DNS query traffic on port 53.

Answer

The team should provision a Global External SSL Proxy Load Balancer for edge TLS termination of raw TCP traffic, and create a Cloud DNS Private Zone for internal VPC name resolution.
For requirement 1, the Global External SSL Proxy Load Balancer is designed specifically for terminating SSL/TLS connections at the edge for non-HTTP raw TCP traffic. For requirement 2, a Cloud DNS Private Zone provides secure, private name resolution for internal domain names accessible only within authorized VPC networks.

Step-by-Step Solution

1
Analyze the load balancing protocol and scope requirements.
The application requires global external internet ingress, TLS offloading at the edge, and non-HTTP raw TCP protocol proxying.
An SSL Proxy Load Balancer is a Layer 4 external reverse proxy that offloads SSL/TLS at the edge and forwards raw TCP traffic to backends. Application Load Balancers (L7) cannot process raw non-HTTP protocols.
2
Analyze the DNS resolution and privacy requirements.
Internal microservices need custom private domain resolution (`game.internal`) restricted to the VPC.
Cloud DNS Private Zones allow managing DNS records that are resolvable only within designated VPC networks, keeping DNS traffic isolated from the public internet.

Key Concept

Selecting L4 vs L7 external load balancers based on protocol requirements and isolating internal DNS using Cloud DNS Private Zones.
Rate this question

Topics

Planning Network Load Balancing, Cloud DNS, and Cloud CDN

More questions from this topic