Question

Difficulty: EasyDeploying Cloud Load Balancers and Configuring Cloud DNS

You are deploying a regional Internal Application Load Balancer in a Google Cloud VPC network to distribute HTTP traffic across Compute Engine backend instances. Which TWO networking prerequisites or configurations are required for the load balancer to operate properly? (Select TWO.)

  1. Create a proxy-only subnet in the region where the load balancer is being deployed.Answer
  2. Configure ingress firewall rules to allow traffic from the proxy-only subnet CIDR range to the backend instances.Answer
  3. C
    Assign a global external static IP address to the load balancer forwarding rule.
  4. D
    Enable the Cloud DNS API at the GCP Organization resource level.

Answer

Creating a proxy-only subnet in the deployment region and configuring ingress firewall rules to permit traffic from the proxy-only subnet range to the backend instances are required.
Regional Internal Application Load Balancers deploy Envoy proxies that operate inside a dedicated proxy-only subnet in the region. In addition, ingress firewall rules must be created to allow traffic from the proxy-only subnet IP address range to reach the application ports on the backend VM instances.

Step-by-Step Solution

1
Identify regional internal load balancing architecture requirements
Recognize that Envoy-based regional internal load balancers require a dedicated proxy-only subnet in the specified region.
Envoy proxies reside inside the proxy-only subnet to receive requests and dispatch them to backend instances.
2
Configure network security for proxy traffic
Define ingress firewall rules permitting connections from the proxy-only subnet IP range to the backend ports.
Firewalls block ingress by default, so connections coming from the load balancer's proxy instances must be explicitly allowed.

Key Concept

Internal Application Load Balancer Deployment Requirements
Rate this question