Examkin

Question

Difficulty: Very hardPlanning Network Load Balancing, Cloud DNS, and Cloud CDN

An enterprise is designing a multi-region Google Cloud network topology for two workloads: a public-facing static web portal and a private internal microservices application using gRPC over HTTP/2. The network design must satisfy the following architectural constraints:
1. The public static web portal requires global SSL termination, edge content caching, and web application firewall protection.
2. The internal gRPC microservices must be accessible exclusively from on-premises systems over Dedicated Interconnect and from authorized internal VPC subnets, requiring layer 7 content-based routing and internal load balancing across multiple regions.

Which TWO network architectural components should be included in the design to meet these requirements?

  1. Global External Application Load Balancer configured with Cloud CDN and Cloud Armor security policies for the web portal backend.Answer
  2. Internal Application Load Balancer configured with proxy-only subnets in each targeted region to handle gRPC and HTTP/2 internal traffic.Answer
  3. C
    External Passthrough Network Load Balancer with Cloud CDN backend buckets enabled for the public static web portal.
  4. D
    Internal Passthrough Network Load Balancer configured with Cloud Armor security policies for filtering gRPC protocol traffic.

Answer

The architecture requires a Global External Application Load Balancer integrated with Cloud CDN and Cloud Armor for the public portal, alongside an Internal Application Load Balancer utilizing proxy-only subnets for private gRPC internal routing.
The solution requires two distinct load balancer types. The public portal demands Layer 7 services (SSL termination, Cloud CDN caching, and Cloud Armor WAF protection), which are features exclusive to External Application Load Balancers. The private gRPC service requires Layer 7 internal routing over HTTP/2 and Cloud Interconnect, which is provided by Internal Application Load Balancers utilizing proxy-only subnets.

Step-by-Step Solution

1
Analyze public static web portal requirements.
Identified Layer 7 requirements: SSL termination, Cloud CDN edge caching, and Cloud Armor WAF integration. Only External Application Load Balancers (Layer 7) support Cloud CDN integration.
Passthrough Layer 4 load balancers cannot evaluate HTTP headers or integrate directly with Cloud CDN edge proxies.
2
Analyze internal gRPC microservices requirements.
Identified Layer 7 internal requirements: HTTP/2 and gRPC protocol support, internal VPC and Cloud Interconnect reachability.
Internal Application Load Balancing provides Layer 7 capabilities for internal traffic and requires proxy-only subnets to deliver traffic to backends.
3
Evaluate candidate GCP load balancing products.
Selected Global External Application Load Balancer and Internal Application Load Balancer as the two correct solutions.
Matches all protocol, caching, security, and private reachability constraints according to Google Cloud recommended practices.

Key Concept

Selecting GCP Load Balancers based on traffic scope (Internal vs External), protocol layer (L4 vs L7), and feature integrations (Cloud CDN, Cloud Armor, proxy-only subnets).
Rate this question

Topics

Planning Network Load Balancing, Cloud DNS, and Cloud CDN

More questions from this topic