Your organization is establishing shared networking across multiple Google Cloud projects. A producer team has deployed a microservice behind an internal load balancer and exposed it using a Private Service Connect (PSC) service attachment. Your DevOps team needs to configure connectivity from a consumer VPC network while meeting the following requirements: Route consumer traffic privately to the published service attachment without establishing VPC Network Peering. Apply Google Cloud Armor security policies and custom request header transformations on the consumer side. Enable detailed request logging and Layer 7 traffic management for all egress traffic destined for the producer service. Which configuration should the DevOps team implement in the consumer network?

Create a Private Service Connect network endpoint group (NEG) pointing to the service attachment URI, and configure it as a backend for an internal Application Load Balancer.: What Private Service Connect backends are A Private Service Connect (PSC) backend utilizes a specialized PSC network endpoint group (NEG) that targets the producer's service attachment URI. This configuration allows an Application Load Balancer (internal or external regional) in the consumer network to treat the producer's published service as a standard backend service. How it meets the requirements Private routing without VPC Peering: The PSC NEG routes traffic over Google's private network infrastructure directly to the service attachment, eliminating the need for VPC Network Peering, shared IP address ranges, or route table exchanges. Google Cloud Armor and header transformations: Because traffic enters an Application Load Balancer, consumer administrators can attach Google Cloud Armor security policies to protect outbound traffic and configure request header manipulation (such as inserting tracking or authorization headers) at the load balancer level. Observability and Layer 7 traffic management: The Application Load Balancer provides comprehensive Cloud Logging, connection logging, and advanced Layer 7 routing capabilities such as URL rewriting and redirection before dispatching requests to the producer. Key advantages and capabilities Decoupled address spaces: Requires no coordination of RFC 1918 CIDR blocks between consumer and producer VPCs. Advanced traffic steering: Supports URL maps, weighted routing, and path-based routing policies natively. Security perimeter enforcement: Allows consumer teams to enforce inspection and rate-limiting using Cloud Armor before traffic exits the consumer boundary. Certificate management: Provides SSL/TLS termination and client certificate validation at the consumer load balancing layer. Why this is optimal A PSC backend with a PSC NEG is the only Google Cloud architectural pattern that combines the private isolation of Private Service Connect with the Layer 7 capabilities, Cloud Armor integration, and fine-grained request decoration of Application Load Balancers.

StudyCerts

Professional Cloud DevOps Engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Configure Psc Backend Neg Load Balancer

Section: Shared networking (e.g., Shared VPC, VPC Network Peering, Private Service Connect)

Your organization is establishing shared networking across multiple Google Cloud projects. A producer team has deployed a microservice behind an internal load balancer and exposed it using a Private Service Connect (PSC) service attachment.

Your DevOps team needs to configure connectivity from a consumer VPC network while meeting the following requirements:

Route consumer traffic privately to the published service attachment without establishing VPC Network Peering.
Apply Google Cloud Armor security policies and custom request header transformations on the consumer side.
Enable detailed request logging and Layer 7 traffic management for all egress traffic destined for the producer service.

Which configuration should the DevOps team implement in the consumer network?

Create a Cloud DNS forwarding zone to query Service Directory, and attach Cloud Armor policies to the Service Directory endpoint.

Create a Private Service Connect network endpoint group (NEG) pointing to the service attachment URI, and configure it as a backend for an internal Application Load Balancer.

Configure Private Services Access with an allocated IP range, and establish a VPC Network Peering connection to the producer network.

Create a Private Service Connect endpoint forwarding rule pointing directly to the service attachment URI, and attach a Cloud Armor security policy to the forwarding rule.

Professional Cloud DevOps Engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Configure Psc Backend Neg Load Balancer

Section: Shared networking (e.g., Shared VPC, VPC Network Peering, Private Service Connect)

Your DevOps team needs to configure connectivity from a consumer VPC network while meeting the following requirements:

Route consumer traffic privately to the published service attachment without establishing VPC Network Peering.
Apply Google Cloud Armor security policies and custom request header transformations on the consumer side.
Enable detailed request logging and Layer 7 traffic management for all egress traffic destined for the producer service.

Which configuration should the DevOps team implement in the consumer network?

Create a Cloud DNS forwarding zone to query Service Directory, and attach Cloud Armor policies to the Service Directory endpoint.

Create a Private Service Connect network endpoint group (NEG) pointing to the service attachment URI, and configure it as a backend for an internal Application Load Balancer.

Configure Private Services Access with an allocated IP range, and establish a VPC Network Peering connection to the producer network.

Create a Private Service Connect endpoint forwarding rule pointing directly to the service attachment URI, and attach a Cloud Armor security policy to the forwarding rule.

Explanations

What Private Service Connect backends are

A Private Service Connect (PSC) backend utilizes a specialized PSC network endpoint group (NEG) that targets the producer's service attachment URI. This configuration allows an Application Load Balancer (internal or external regional) in the consumer network to treat the producer's published service as a standard backend service.

How it meets the requirements

Private routing without VPC Peering: The PSC NEG routes traffic over Google's private network infrastructure directly to the service attachment, eliminating the need for VPC Network Peering, shared IP address ranges, or route table exchanges.
Google Cloud Armor and header transformations: Because traffic enters an Application Load Balancer, consumer administrators can attach Google Cloud Armor security policies to protect outbound traffic and configure request header manipulation (such as inserting tracking or authorization headers) at the load balancer level.
Observability and Layer 7 traffic management: The Application Load Balancer provides comprehensive Cloud Logging, connection logging, and advanced Layer 7 routing capabilities such as URL rewriting and redirection before dispatching requests to the producer.

Key advantages and capabilities

Decoupled address spaces: Requires no coordination of RFC 1918 CIDR blocks between consumer and producer VPCs.
Advanced traffic steering: Supports URL maps, weighted routing, and path-based routing policies natively.
Security perimeter enforcement: Allows consumer teams to enforce inspection and rate-limiting using Cloud Armor before traffic exits the consumer boundary.
Certificate management: Provides SSL/TLS termination and client certificate validation at the consumer load balancing layer.

Why this is optimal

A PSC backend with a PSC NEG is the only Google Cloud architectural pattern that combines the private isolation of Private Service Connect with the Layer 7 capabilities, Cloud Armor integration, and fine-grained request decoration of Application Load Balancers.

View source documentation

Professional Cloud DevOps Engineer

Configure Psc Backend Neg Load Balancer

Professional Cloud DevOps Engineer

Configure Psc Backend Neg Load Balancer

What Private Service Connect backends are

How it meets the requirements

Key advantages and capabilities

Why this is optimal

Related questions

IAM Permissions Bundled into Roles