An enterprise IoT management solution running on Compute Engine instances inside a Virtual Private Cloud (VPC) receives raw, non-HTTP TCP telemetry data on port 8883 from internal client instances. The client instances must reach the load balancing backend using a private domain name (iot.internal.example.com), and the solution must preserve client source IP addresses for logging. Which TWO architectural components should you configure to meet these requirements?
- An Internal Passthrough Network Load Balancer targeting the backend Compute Engine instance group on TCP port 8883Answer
- A Cloud DNS private managed zone containing an A record for iot.internal.example.com pointing to the load balancer forwarding rule IPAnswer
- CAn Internal Application Load Balancer with Cloud CDN enabled for the backend service
- DAn External Passthrough Network Load Balancer combined with a Cloud DNS public managed zone
Answer
Configure an Internal Passthrough Network Load Balancer targeting the Compute Engine instance group on TCP port 8883, and set up a Cloud DNS private managed zone with an A record pointing to the load balancer forwarding rule IP address.
For internal non-HTTP TCP traffic (such as telemetry over port 8883) that requires preserving client IP addresses, an Internal Passthrough Network Load Balancer is required because it functions at Layer 4 without proxying. Furthermore, resolving custom domain names privately inside a VPC requires a Cloud DNS private managed zone associated with that VPC network.
Step-by-Step Solution
Key Concept
Planning Layer 4 Internal Load Balancing and Private DNS Resolution
Estimated Time:1m 30s