GCP Professional Cloud Architect Practice Question
Your company operates a latency-sensitive public API in GKE clusters deployed in us-central1 and europe-west1. A Cloud Run service must handle only requests to the /metrics path. You need to expose a single anycast public IP that automatically directs traffic to the nearest healthy region with failover, terminates TLS at Google's edge while encrypting traffic to every backend, and preserves the original client IP inside the pods. Which Google Cloud load-balancing architecture should you implement?
Configure a global external HTTP(S) load balancer (backend-service/Envoy) with regional NEGs for the GKE clusters and a serverless NEG for Cloud Run, enabling TLS to backends.
Create a regional internal HTTP(S) load balancer and publish it through Cloud DNS with geo-location-based A records pointing to each region's VIP.
Provision classic external HTTP(S) load balancers in each region, assign separate forwarding rules, and rely on DNS weighted round-robin for distribution and failover.
Deploy a global TCP proxy load balancer in front of the GKE clusters and use Cloud Armor plus Cloud Run domain mapping for the /metrics path.
A global external HTTP(S) load balancer that uses the backend-service (Envoy-based) architecture meets all requirements. It provides a single anycast virtual IP, performs layer-7 path-based routing so /metrics requests can be sent to a serverless NEG for Cloud Run while other paths go to regional NEGs for the GKE clusters, automatically fails over to healthy regions, terminates TLS at Google's edge and initiates TLS when connecting to backends, and passes the original client IP address in the X-Forwarded-For header to the pods. Regional internal HTTP(S) load balancers are not publicly routable; TCP proxy load balancers cannot perform HTTP path routing or integrate with Cloud Run; deploying classic external HTTP(S) load balancers per region would require multiple IP addresses and DNS-based failover rather than automatic cross-region failover.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is a global external HTTP(S) load balancer in GCP?
Open an interactive chat with Bash
What is a NEG (Network Endpoint Group) in GCP?
Open an interactive chat with Bash
How does TLS termination work in Google Cloud Load Balancers?
Open an interactive chat with Bash
What is a NEG in Google Cloud?
Open an interactive chat with Bash
What does anycast IP mean for load balancing?
Open an interactive chat with Bash
How does TLS termination work at Google’s edge?
Open an interactive chat with Bash
GCP Professional Cloud Architect
Designing and planning a cloud solution architecture
Your Score:
Report Issue
Bash, the Crucial Exams Chat Bot
AI Bot
Loading...
Loading...
Loading...
Pass with Confidence.
IT & Cybersecurity Package
You have hit the limits of our free tier, become a Premium Member today for unlimited access.
Military, Healthcare worker, Gov. employee or Teacher? See if you qualify for a Community Discount.
Monthly
$19.99
$19.99/mo
Billed monthly, Cancel any time.
3 Month Pass
$44.99
$14.99/mo
One time purchase of $44.99, Does not auto-renew.
MOST POPULAR
Annual Pass
$119.99
$9.99/mo
One time purchase of $119.99, Does not auto-renew.
BEST DEAL
Lifetime Pass
$189.99
One time purchase, Good for life.
What You Get
All IT & Cybersecurity Package plans include the following perks and exams .