Your organization is establishing shared networking across multiple Google Cloud projects. A producer team has deployed a microservice behind an internal load balancer and exposed it using a Private Service Connect (PSC) service attachment. Your DevOps team needs to configure connectivity from a consumer VPC network while meeting the following requirements: Route consumer traffic privately to the published service attachment without establishing VPC Network Peering. Apply Google Cloud Armor security policies and custom request header transformations on the consumer side. Enable detailed request logging and Layer 7 traffic management for all egress traffic destined for the producer service. Which configuration should the DevOps team implement in the consumer network?

Create a Private Service Connect network endpoint group (NEG) pointing to the service attachment URI, and configure it as a backend for an internal Application Load Balancer.: ### What Private Service Connect backends are A **Private Service Connect (PSC) backend** utilizes a specialized **PSC network endpoint group (NEG)** that targets the producer's **service attachment URI**. This configuration allows an **Application Load Balancer** (internal or external regional) in the consumer network to treat the producer's published service as a standard backend service. ### How it meets the requirements - **Private routing without VPC Peering:** The PSC NEG routes traffic over Google's private network infrastructure directly to the service attachment, eliminating the need for **VPC Network Peering**, shared IP address ranges, or route table exchanges. - **Google Cloud Armor and header transformations:** Because traffic enters an **Application Load Balancer**, consumer administrators can attach **Google Cloud Armor** security policies to protect outbound traffic and configure **request header manipulation** (such as inserting tracking or authorization headers) at the load balancer level. - **Observability and Layer 7 traffic management:** The Application Load Balancer provides comprehensive **Cloud Logging**, connection logging, and advanced Layer 7 routing capabilities such as URL rewriting and redirection before dispatching requests to the producer. ### Key advantages and capabilities - **Decoupled address spaces:** Requires no coordination of RFC 1918 CIDR blocks between consumer and producer VPCs. - **Advanced traffic steering:** Supports URL maps, weighted routing, and path-based routing policies natively. - **Security perimeter enforcement:** Allows consumer teams to enforce inspection and rate-limiting using Cloud Armor before traffic exits the consumer boundary. - **Certificate management:** Provides SSL/TLS termination and client certificate validation at the consumer load balancing layer. ### Why this is optimal A PSC backend with a PSC NEG is the only Google Cloud architectural pattern that combines the private isolation of Private Service Connect with the Layer 7 capabilities, Cloud Armor integration, and fine-grained request decoration of Application Load Balancers.

Configure Psc Backend Neg Load Balancer | Professional Cloud DevOps Engineer

Configure Psc Backend Neg Load Balancer

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

Your organization is establishing shared networking across multiple Google Cloud projects. A producer team has deployed a microservice behind an internal load balancer and exposed it using a Private Service Connect (PSC) service attachment.

Your DevOps team needs to configure connectivity from a consumer VPC network while meeting the following requirements:

Route consumer traffic privately to the published service attachment without establishing VPC Network Peering.
Apply Google Cloud Armor security policies and custom request header transformations on the consumer side.
Enable detailed request logging and Layer 7 traffic management for all egress traffic destined for the producer service.

Which configuration should the DevOps team implement in the consumer network?

Configure Private Services Access with an allocated IP range, and establish a VPC Network Peering connection to the producer network.

Create a Private Service Connect network endpoint group (NEG) pointing to the service attachment URI, and configure it as a backend for an internal Application Load Balancer.

Create a Cloud DNS forwarding zone to query Service Directory, and attach Cloud Armor policies to the Service Directory endpoint.

Create a Private Service Connect endpoint forwarding rule pointing directly to the service attachment URI, and attach a Cloud Armor security policy to the forwarding rule.

Professional Cloud DevOps Engineer

Configure Psc Backend Neg Load Balancer

Related questions