An enterprise is designing a globally distributed multi-tier web application deployed across multiple Google Cloud regions. The compute backends reside in multiple service projects connected to a centralized Shared VPC hosted in a dedicated Production folder. The architecture must meet the following requirements: Route global user traffic with minimal latency and automatically overflow excess traffic to the next closest region when a regional backend reaches capacity. Centrally enforce baseline firewall rules ensuring that Google Front End (GFE) proxies and health checking systems can communicate with backend instances across all service projects. Prevent individual service project teams from overriding or disrupting the core load balancer communication paths. Which architecture and security implementation should you recommend?

Deploy a Global External Application Load Balancer, and attach a hierarchical firewall policy to the Production folder that allows ingress from 35.191.0.0/16 and 130.211.0.0/22 to the backend instances.: What Global External Application Load Balancing and Hierarchical Firewall Policies Are A Global External Application Load Balancer is a Layer 7 load balancer built on globally distributed Google Front End (GFE) proxies that terminates HTTP(S) traffic at points of presence (PoPs) close to users. A hierarchical firewall policy allows organization or folder administrators to define and enforce firewall rules across the entire resource hierarchy, taking precedence over project-level and VPC-level firewall rules. How it meets all requirements Global traffic routing and automatic overflow: The Global External Application Load Balancer uses the Waterfall by Region algorithm. Traffic is directed to the closest healthy backend region, and if a region exceeds its defined capacity threshold or becomes unhealthy, requests automatically and seamlessly overflow to the next closest region with available capacity. Centralized baseline enforcement: In a Shared VPC architecture, VM interfaces connected to the Shared VPC network inherit firewall policies from the host project's folder ancestry. Attaching the hierarchical firewall policy to the Production folder covering the host project centrally applies the policy to all backends across all connected service projects. Preventing team overrides: Hierarchical firewall rules are evaluated before VPC firewall rules and cannot be overridden or removed by project-level administrators or service project owners. Key advantages and capabilities Single Anycast IP: Provides global Anycast routing so users worldwide connect to the nearest edge location. Consistent security posture: Ensures mandatory GFE proxy and health check probe CIDRs (35.191.0.0/16 and 130.211.0.0/22) are permitted without depending on decentralized service project configurations. Intelligent traffic management: Dynamically accounts for backend capacity and backend health without relying on DNS TTL delays. Why this is optimal This solution combines edge-terminated global HTTP(S) distribution with enterprise governance. It guarantees optimal multi-region traffic balancing while enforcing immutable security perimeters across distributed application backends.

StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Hierarchical Firewalls Global Alb Shared Vpc

Section: Cloud-native networking (e.g., virtual private cloud [VPC], peering, firewalls, load balancers, routing, container networking, shared VPC, and Private Service Connect)

An enterprise is designing a globally distributed multi-tier web application deployed across multiple Google Cloud regions. The compute backends reside in multiple service projects connected to a centralized Shared VPC hosted in a dedicated Production folder.

The architecture must meet the following requirements:

Route global user traffic with minimal latency and automatically overflow excess traffic to the next closest region when a regional backend reaches capacity.
Centrally enforce baseline firewall rules ensuring that Google Front End (GFE) proxies and health checking systems can communicate with backend instances across all service projects.
Prevent individual service project teams from overriding or disrupting the core load balancer communication paths.

Which architecture and security implementation should you recommend?

Deploy a Global External Application Load Balancer, and attach a hierarchical firewall policy to the Production folder that allows ingress from 35.191.0.0/16 and 130.211.0.0/22 to the backend instances.

Deploy a Global External Application Load Balancer, and create local VPC firewall rules in each service project allowing ingress from 0.0.0.0/0 on port 80 and port 443.

Deploy an External Passthrough Network Load Balancer in each region, and configure regional network firewall policies in each service project allowing ingress from 0.0.0.0/0.

Deploy an Internal Application Load Balancer with cross-region routing, and configure a hierarchical firewall policy attached to each service project allowing ingress from 169.254.169.254.

Professional Cloud Architect

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Hierarchical Firewalls Global Alb Shared Vpc

Section: Cloud-native networking (e.g., virtual private cloud [VPC], peering, firewalls, load balancers, routing, container networking, shared VPC, and Private Service Connect)

The architecture must meet the following requirements:

Route global user traffic with minimal latency and automatically overflow excess traffic to the next closest region when a regional backend reaches capacity.
Centrally enforce baseline firewall rules ensuring that Google Front End (GFE) proxies and health checking systems can communicate with backend instances across all service projects.
Prevent individual service project teams from overriding or disrupting the core load balancer communication paths.

Which architecture and security implementation should you recommend?

Deploy a Global External Application Load Balancer, and create local VPC firewall rules in each service project allowing ingress from 0.0.0.0/0 on port 80 and port 443.

Deploy an External Passthrough Network Load Balancer in each region, and configure regional network firewall policies in each service project allowing ingress from 0.0.0.0/0.

Deploy an Internal Application Load Balancer with cross-region routing, and configure a hierarchical firewall policy attached to each service project allowing ingress from 169.254.169.254.

Explanations

What Global External Application Load Balancing and Hierarchical Firewall Policies Are

A Global External Application Load Balancer is a Layer 7 load balancer built on globally distributed Google Front End (GFE) proxies that terminates HTTP(S) traffic at points of presence (PoPs) close to users. A hierarchical firewall policy allows organization or folder administrators to define and enforce firewall rules across the entire resource hierarchy, taking precedence over project-level and VPC-level firewall rules.

How it meets all requirements

Global traffic routing and automatic overflow: The Global External Application Load Balancer uses the Waterfall by Region algorithm. Traffic is directed to the closest healthy backend region, and if a region exceeds its defined capacity threshold or becomes unhealthy, requests automatically and seamlessly overflow to the next closest region with available capacity.
Centralized baseline enforcement: In a Shared VPC architecture, VM interfaces connected to the Shared VPC network inherit firewall policies from the host project's folder ancestry. Attaching the hierarchical firewall policy to the Production folder covering the host project centrally applies the policy to all backends across all connected service projects.
Preventing team overrides: Hierarchical firewall rules are evaluated before VPC firewall rules and cannot be overridden or removed by project-level administrators or service project owners.

Key advantages and capabilities

Single Anycast IP: Provides global Anycast routing so users worldwide connect to the nearest edge location.
Consistent security posture: Ensures mandatory GFE proxy and health check probe CIDRs (35.191.0.0/16 and 130.211.0.0/22) are permitted without depending on decentralized service project configurations.
Intelligent traffic management: Dynamically accounts for backend capacity and backend health without relying on DNS TTL delays.

Why this is optimal

This solution combines edge-terminated global HTTP(S) distribution with enterprise governance. It guarantees optimal multi-region traffic balancing while enforcing immutable security perimeters across distributed application backends.

View source documentation

Professional Cloud Architect

Hierarchical Firewalls Global Alb Shared Vpc

Professional Cloud Architect

Hierarchical Firewalls Global Alb Shared Vpc

What Global External Application Load Balancing and Hierarchical Firewall Policies Are

How it meets all requirements

Key advantages and capabilities

Why this is optimal

Related questions