An enterprise organization is deploying an internet-facing web service on Compute Engine instances in Google Cloud. The security and compliance teams have defined the following technical and architectural requirements: Jurisdictional compliance: Transport Layer Security (TLS) decryption and session termination must strictly occur within the europe-west3 region; terminating TLS at globally distributed edge points of presence (PoPs) is prohibited. Application traffic management: The load balancer must evaluate HTTP(S) request attributes to support URL path-based routing, header transformations, and percentage-based canary traffic splitting. Network perimeter isolation: Managed proxies handling the traffic must reside within the VPC network and draw IP addresses from a dedicated, reserved proxy-only subnet in the region. Which load balancing architecture should the security engineer deploy to satisfy all requirements?

Deploy a Regional external Application Load Balancer in europe-west3, reserve a regional proxy-only subnet in the VPC, and attach a regional SSL certificate and regional URL map.: ### What a Regional external Application Load Balancer is A **Regional external Application Load Balancer** is a regional, proxy-based Layer 7 load balancer built on managed open-source **Envoy proxies**. It distributes external HTTP and HTTPS traffic to backend services situated in a single specific Google Cloud region while supporting advanced traffic management and security features. ### How it meets the requirements - **Jurisdictional compliance:** Regional external Application Load Balancers guarantee that TLS termination occurs strictly within the designated Google Cloud region (`europe-west3`), ensuring complete compliance with data sovereignty and geographic isolation mandates. - **Application traffic management:** Built-in Envoy-based Layer 7 capabilities allow advanced **URL maps**, **path-based routing**, header transformations, and weight-based canary traffic splitting without code modifications. - **Network perimeter isolation:** Regional external Application Load Balancers deploy Envoy proxies directly into the customer's VPC network, requiring and utilizing an allocated **proxy-only subnet** (`REGIONAL_MANAGED_PROXY`) to connect to backend VMs. ### Key advantages - **Strict data residency:** Guarantees that unencrypted plaintext payloads never leave the designated geographic boundary. - **Full Layer 7 feature parity:** Supports URL rewrites, redirects, header manipulation, and granular routing rules. - **Consistent security integration:** Seamlessly integrates with regional backend services, health checks, and regional Cloud Armor security policies. - **VPC isolation:** Internal communication from the load balancer proxy to backend instances originates from a controlled, dedicated subnet range. ### Why this is optimal Compared to global load balancers, the regional external Application Load Balancer isolates all proxy execution, cryptographic operations, and Layer 7 processing to the specified region (`europe-west3`), perfectly aligning with regulatory mandates while providing complete HTTP(S) routing capabilities.

Regional External Application Load Balancer Jurisdiction | Professional Cloud Security Engineer

Regional External Application Load Balancer Jurisdiction

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise organization is deploying an internet-facing web service on Compute Engine instances in Google Cloud. The security and compliance teams have defined the following technical and architectural requirements:

Jurisdictional compliance: Transport Layer Security (TLS) decryption and session termination must strictly occur within the europe-west3 region; terminating TLS at globally distributed edge points of presence (PoPs) is prohibited.
Application traffic management: The load balancer must evaluate HTTP(S) request attributes to support URL path-based routing, header transformations, and percentage-based canary traffic splitting.
Network perimeter isolation: Managed proxies handling the traffic must reside within the VPC network and draw IP addresses from a dedicated, reserved proxy-only subnet in the region.

Which load balancing architecture should the security engineer deploy to satisfy all requirements?

Deploy a Global external Application Load Balancer in Premium Tier with backends in europe-west3, and configure a global SSL certificate and global URL map.

Deploy a Regional external Application Load Balancer in europe-west3, reserve a regional proxy-only subnet in the VPC, and attach a regional SSL certificate and regional URL map.

Deploy a Regional external proxy Network Load Balancer in europe-west3, reserve a proxy-only subnet, and configure an SSL target proxy with advanced URL maps.

Deploy an External passthrough Network Load Balancer in europe-west3 with a regional backend service and configure an SSL target proxy.

Professional Cloud Security Engineer

Regional External Application Load Balancer Jurisdiction

Related questions