Examkin

Question

Difficulty: MediumPlanning Network Load Balancing, Cloud DNS, and Cloud CDN

An organization is deploying an internal backend authentication microservice on Compute Engine instances distributed across multiple zones within a single Google Cloud VPC region. The microservice processes raw, non-HTTP TCP traffic on custom port 9090 from client application VMs located inside the same VPC network. The solution must provide internal load balancing with continuous health checks and allow client VMs to access the microservice using a custom internal domain name (auth.internal.example.com). Which TWO architectural actions should you take to meet these requirements?

  1. Deploy an Internal Passthrough Network Load Balancer with an internal IP frontend to distribute raw TCP port 9090 traffic across the Compute Engine backend instances.Answer
  2. B
    Deploy an External Application Load Balancer to terminate incoming raw TCP port 9090 traffic and proxy requests to the Compute Engine instances.
  3. Create a Cloud DNS Private Managed Zone bound to the VPC network that maps auth.internal.example.com to the internal IP of the load balancer.Answer
  4. D
    Create a Cloud DNS Public Managed Zone and register auth.internal.example.com with public NS records targeting the load balancer.

Answer

The correct architecture requires deploying an Internal Passthrough Network Load Balancer to route raw TCP port 9090 traffic inside the VPC, and configuring a Cloud DNS Private Managed Zone bound to the VPC network to resolve the internal FQDN to the load balancer's private IP address.
Deploying an Internal Passthrough Network Load Balancer provides regional Layer 4 load balancing for raw non-HTTP TCP traffic on custom ports within a private VPC network. Pairing this with a Cloud DNS Private Managed Zone linked to the VPC enables client instances to securely resolve internal domain names to the load balancer's private frontend IP address.

Step-by-Step Solution

1
Evaluate load balancing requirements based on protocol and network scope.
Identified that the microservice uses raw non-HTTP TCP traffic on port 9090 and serves internal VPC clients only.
Layer 4 Internal Passthrough Network Load Balancing is required because Layer 7 proxies (Application Load Balancers) do not support arbitrary non-HTTP TCP protocols.
2
Evaluate DNS resolution requirements for internal VPC hosts.
Identified that client VMs within the VPC need to resolve an internal domain name (auth.internal.example.com) to a private IP address.
Cloud DNS Private Managed Zones provide internal name resolution restricted to authorized VPC networks without public exposure.

Key Concept

Selecting appropriate GCP load balancers for Layer 4 non-HTTP VPC traffic and configuring Cloud DNS Private Managed Zones for internal name resolution.
Estimated Time:1m 30s
Rate this question

Topics

Planning Network Load Balancing, Cloud DNS, and Cloud CDN

More questions from this topic