An online retail organization is preparing for a global flash sale that will generate massive, sudden spikes in HTTPS web traffic from users worldwide. The application frontend is deployed across Compute Engine Managed Instance Groups (MIGs) located in North America, Europe, and Asia. The architecture must satisfy the following technical requirements: Minimize round-trip latency and TCP/TLS handshake time for users worldwide. Automatically direct traffic to the nearest geographic backend with available capacity. Seamlessly overflow excess traffic to the next closest healthy region if a primary regional instance group reaches its maximum capacity limits. Which Cloud Load Balancing architecture should you implement?

Deploy a Global external Application Load Balancer in Premium Tier with a global backend service referencing the multi-region instance groups configured with utilization or rate capacity limits.: What the Global External Application Load Balancer Is A Global external Application Load Balancer is a proxy-based Layer 7 system implemented across distributed Google Front Ends (GFEs) at Google's global edge Points of Presence (PoPs). Operating in the Premium Network Service Tier, it exposes a single global Anycast IP address and routes incoming HTTP(S) traffic over Google's private fiber backbone directly to multi-region backends. How It Meets the Requirements Low-Latency Edge Termination: The load balancer terminates client TCP and TLS sessions at the closest edge PoP using Google Front Ends (GFEs). This eliminates multiple long-haul transoceanic round-trips for handshakes, drastically reducing Time to First Byte (TTFB). Proximity-Based Steering: It automatically steers user requests to the geographically closest backend Managed Instance Group (MIG) that passes health checks and has available capacity. Automatic Capacity Overflow Handling: By defining capacity limits (such as UTILIZATION or RPS) on the global backend service, the load balancer automatically overflows excess traffic to the next closest region with available capacity when a region hits its threshold. Key Advantages and Capabilities Single Anycast Virtual IP (VIP): Eliminates complex DNS-based load balancing and geo-routing propagation delays. Intelligent Traffic Spreading: Re-routes traffic away from unhealthy or saturated backend instances seamlessly. Advanced Layer 7 Management: Enables URL mapping, header-based routing, traffic splitting, and deep integration with Google Cloud Armor and Cloud CDN. High Availability: Fully resilient to zonal and regional service outages. Why This Is Optimal Unlike regional load balancers or DNS-based failover, the global external Application Load Balancer in Premium Tier actively calculates latency and backend capacity per request, providing seamless global scalability and automated traffic overflow without client interruption.

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Intermediate

Prepare and test your skills

Global External Application Load Balancer Edge Routing

Section: Scalability to meet growth requirements

...

Explanations

...

View source documentation

Keep the momentum going with these hand-picked practice scenarios

IntermediateProfessional Cloud Architect

An enterprise runs a multi-tier analytics application on Google Kubernetes Engine (GKE). A backend workload running in the data-processing namespace requires access to Cloud Storage and Cloud Bigtable. The security team mandates the following requirements: The backend application must authenticate to Google Cloud APIs following the principle of least privilege, without managing or storing long-lived service account keys in the cluster. Pods running on the same node pool from other namespaces must not inherit the backend workload's Google Cloud API permissions. Network traffic must be restricted at Layer 4 so that backend Pods only allow authorized cluster communication and can reach the required Google Cloud endpoints. Which architectural approach should you implement to satisfy these requirements?

Container orchestration

IntermediateProfessional Cloud Architect

SLOs, TCO, and Proof of Concept Assessment

Decision-making processes

AdvancedProfessional Cloud Security Engineer

A financial enterprise is updating its identity governance and privilege escalation policies across several Google Cloud production projects. The security team wants to eliminate permanent administrative role bindings, establish automated justification and approval workflows for time-bound access elevations integrated with their ITSM platform, and automatically detect when dormant service accounts are granted unauthorized impersonation roles. Which combination of Google Cloud features should the security engineer implement to satisfy these requirements?

Automating the user lifecycle management process.

Want more questions like this?

Get a free certification question every week.

Last updated August 28, 2026

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Intermediate

Prepare and test your skills

Global External Application Load Balancer Edge Routing

Section: Scalability to meet growth requirements

An online retail organization is preparing for a global flash sale that will generate massive, sudden spikes in HTTPS web traffic from users worldwide. The application frontend is deployed across Compute Engine Managed Instance Groups (MIGs) located in North America, Europe, and Asia.

The architecture must satisfy the following technical requirements:

Minimize round-trip latency and TCP/TLS handshake time for users worldwide.
Automatically direct traffic to the nearest geographic backend with available capacity.
Seamlessly overflow excess traffic to the next closest healthy region if a primary regional instance group reaches its maximum capacity limits.

Which Cloud Load Balancing architecture should you implement?

...

Deploy an External passthrough Network Load Balancer in Premium Tier using a regional target pool across multiple zones.

...

Deploy a Cross-region internal Application Load Balancer with global access enabled and fronted by regional Cloud NAT gateways.

...

Deploy a Global external Application Load Balancer in Premium Tier with a global backend service referencing the multi-region instance groups configured with utilization or rate capacity limits.

...

Deploy individual Regional external Application Load Balancers in Standard Tier in each region, and configure Cloud DNS geolocation routing policies with health checking.

...

Explanations

What the Global External Application Load Balancer Is

A Global external Application Load Balancer is a proxy-based Layer 7 system implemented across distributed Google Front Ends (GFEs) at Google's global edge Points of Presence (PoPs). Operating in the Premium Network Service Tier, it exposes a single global Anycast IP address and routes incoming HTTP(S) traffic over Google's private fiber backbone directly to multi-region backends.

How It Meets the Requirements

Low-Latency Edge Termination: The load balancer terminates client TCP and TLS sessions at the closest edge PoP using Google Front Ends (GFEs). This eliminates multiple long-haul transoceanic round-trips for handshakes, drastically reducing Time to First Byte (TTFB).
Proximity-Based Steering: It automatically steers user requests to the geographically closest backend Managed Instance Group (MIG) that passes health checks and has available capacity.
Automatic Capacity Overflow Handling: By defining capacity limits (such as UTILIZATION or RPS) on the global backend service, the load balancer automatically overflows excess traffic to the next closest region with available capacity when a region hits its threshold.

Key Advantages and Capabilities

Single Anycast Virtual IP (VIP): Eliminates complex DNS-based load balancing and geo-routing propagation delays.
Intelligent Traffic Spreading: Re-routes traffic away from unhealthy or saturated backend instances seamlessly.
Advanced Layer 7 Management: Enables URL mapping, header-based routing, traffic splitting, and deep integration with Google Cloud Armor and Cloud CDN.
High Availability: Fully resilient to zonal and regional service outages.

Why This Is Optimal

Unlike regional load balancers or DNS-based failover, the global external Application Load Balancer in Premium Tier actively calculates latency and backend capacity per request, providing seamless global scalability and automated traffic overflow without client interruption.

...

View source documentation

Keep the momentum going with these hand-picked practice scenarios

IntermediateProfessional Cloud Architect

Cloud Spanner Multi-Region Horizontal Scaling

Scalability to meet growth requirements

IntermediateProfessional Cloud Architect

Compute Engine Autoscaler Multi-Signal Max Rule

Scalability to meet growth requirements

IntermediateProfessional Cloud Architect

Workload Identity Federation Best Practices

Familiarity with the Google Cloud Well-Architected Framework

IntermediateProfessional Cloud Architect

An enterprise runs a multi-tier analytics application on Google Kubernetes Engine (GKE). A backend workload running in the data-processing namespace requires access to Cloud Storage and Cloud Bigtable. The security team mandates the following requirements: The backend application must authenticate to Google Cloud APIs following the principle of least privilege, without managing or storing long-lived service account keys in the cluster. Pods running on the same node pool from other namespaces must not inherit the backend workload's Google Cloud API permissions. Network traffic must be restricted at Layer 4 so that backend Pods only allow authorized cluster communication and can reach the required Google Cloud endpoints. Which architectural approach should you implement to satisfy these requirements?

Container orchestration

IntermediateProfessional Cloud Architect

SLOs, TCO, and Proof of Concept Assessment

Decision-making processes

AdvancedProfessional Cloud Security Engineer

A financial enterprise is updating its identity governance and privilege escalation policies across several Google Cloud production projects. The security team wants to eliminate permanent administrative role bindings, establish automated justification and approval workflows for time-bound access elevations integrated with their ITSM platform, and automatically detect when dormant service accounts are granted unauthorized impersonation roles. Which combination of Google Cloud features should the security engineer implement to satisfy these requirements?

Automating the user lifecycle management process.

Want more questions like this?

Get a free certification question every week.

Last updated August 28, 2026

An online retail organization is preparing for a global flash sale that will generate massive, sudden spikes in HTTPS web traffic from users worldwide. The application frontend is deployed across Compute Engine Managed Instance Groups (MIGs) located in North America, Europe, and Asia.

The architecture must satisfy the following technical requirements:

Minimize round-trip latency and TCP/TLS handshake time for users worldwide.
Automatically direct traffic to the nearest geographic backend with available capacity.
Seamlessly overflow excess traffic to the next closest healthy region if a primary regional instance group reaches its maximum capacity limits.