Examkin

Question

Difficulty: HardDeploying Cloud Load Balancers and Configuring Cloud DNS

Your organization operates a proprietary backend service running on Compute Engine instances distributed across two regions: `us-central1` and `europe-west1`. The service communicates over raw TCP on port 8443 and does not use HTTP or HTTPS. To meet security requirements, incoming client connections from around the globe must have SSL/TLS terminated at the Google Cloud edge before traffic is routed to the backend instances. Which load balancer configuration should you deploy?

  1. Configure an External TCP Proxy Load Balancer with a Target SSL Proxy and a SSL certificate resource assigned to the frontend forwarding rule.Answer
  2. B
    Configure a Global External Application Load Balancer with a Target HTTPS Proxy and a URL map routing rule.
  3. C
    Configure an External Passthrough Network Load Balancer with a Target Pool and assign SSL certificates directly to the forwarding rule.
  4. D
    Enable Google Cloud Armor and apply an Organization Policy constraint across both regions to terminate SSL connections at the VPC gateway.

Answer

The correct architecture requires an External TCP Proxy Load Balancer configured with a Target SSL Proxy and an SSL certificate, which handles global IPv4/IPv6 client traffic, offloads SSL/TLS encryption at the Google Cloud edge for non-HTTP TCP traffic, and balances backend load across multiple regions.
For non-HTTP traffic requiring global load balancing and SSL/TLS termination at the Google Cloud edge, the correct solution is an External TCP Proxy Load Balancer using a Target SSL Proxy. This configuration offloads cryptographic overhead from backend instances and distributes traffic across multi-region Compute Engine backends.

Step-by-Step Solution

1
Analyze protocol requirements
The application uses non-HTTP raw TCP on port 8443.
Application Load Balancers (HTTP/HTTPS) parse HTTP headers and are unsuitable for raw TCP payloads.
2
Analyze security and edge termination requirements
SSL/TLS offloading must occur at the GCP network edge.
Passthrough load balancers do not terminate SSL/TLS; proxy load balancers are required to offload encryption at the edge.
3
Select the appropriate proxy load balancer type
Use an External TCP Proxy Load Balancer with a Target SSL Proxy.
Target SSL Proxy handles global external non-HTTP TCP traffic with edge SSL termination and cross-region backend routing.

Key Concept

Selecting GCP Load Balancers based on traffic protocol (HTTP vs non-HTTP TCP) and proxy/termination behavior.
Rate this question

Topics

Deploying Cloud Load Balancers and Configuring Cloud DNS

More questions from this topic