Professional Cloud Developer

Geographic Scope and Accessibility Selection

When designing an application, choosing the right geographic reach is the first step. A global load balancer distributes traffic across multiple regions to serve users worldwide through a single Anycast IP address that routes requests to the nearest healthy backend. In contrast, a regional load balancer is best for workloads with strict jurisdictional compliance or latency requirements because it keeps data and processing within a single geographic boundary.

Developers must also classify traffic by accessibility to secure their environments. An external load balancer acts as the entry point for public traffic coming from the internet into Google Cloud. An internal load balancer manages traffic inside a private network, keeping service-to-service communication secure and isolated from the public internet.

Finally, the choice of Network Service Tiers determines how traffic travels across the globe. The Premium Tier uses Google’s high-quality private fiber network to route traffic quickly and reliably. The Standard Tier relies on the public internet, which lowers costs but is limited to regional routing.

Protocol and Layer-Specific Routing

Load balancers operate at different levels of the network stack depending on protocol requirements. An Application Load Balancer operates at Layer 7, allowing it to inspect HTTP and HTTPS traffic for advanced routing decisions. On the other hand, a Network Load Balancer operates at Layer 4 to route raw TCP, UDP, or ICMP packets without reading the application data inside.

Application Load Balancers act as proxies and offer advanced traffic control features. They use URL maps to perform URL-based routing, directing requests to different backends based on hostnames or specific file paths. They also handle SSL termination to manage security certificates at the edge, freeing up backend servers to focus on processing application logic.

Network Load Balancers can run as proxies or as passthrough systems. A passthrough load balancer delivers packets directly to the backend unchanged, which is highly efficient for heavy network workloads. These systems use a technique called Direct Server Return to allow backend servers to respond directly to the client, which bypasses the load balancer on the return path.

Advanced Traffic Management and Security Integration

Advanced routing goes beyond simple distribution to actively control how data moves. Developers use URL maps to enable Traffic Steering, which performs tasks like header changes or URL redirects. This capability supports complex operations like canary testing to split traffic between app versions, or request mirroring to copy live traffic to a test service for safe debugging.

Security services integrate directly at the network edge to block malicious traffic before it reaches your applications. Google Cloud Armor provides Web Application Firewall capabilities to defend against DDoS attacks and other web threats. Additionally, Identity-Aware Proxy verifies user identity before granting access, ensuring only authorized users can reach internal application backends.

To keep applications reliable and fast, load balancers use continuous monitoring and caching. Health checks constantly verify that backend instances are active, automatically rerouting traffic away from any failed servers. Integrating Cloud CDN caches popular content at Edge Points of Presence closer to users, while session affinity keeps a user's requests connected to the same backend to maintain their session state.