An enterprise organization is deploying an internet-facing web service on Compute Engine instances in Google Cloud. The security and compliance teams have defined the following technical and architectural requirements: Jurisdictional compliance: Transport Layer Security (TLS) decryption and session termination must strictly occur within the europe-west3 region; terminating TLS at globally distributed edge points of presence (PoPs) is prohibited. Application traffic management: The load balancer must evaluate HTTP(S) request attributes to support URL path-based routing, header transformations, and percentage-based canary traffic splitting. Network perimeter isolation: Managed proxies handling the traffic must reside within the VPC network and draw IP addresses from a dedicated, reserved proxy-only subnet in the region. Which load balancing architecture should the security engineer deploy to satisfy all requirements?

Deploy a Regional external Application Load Balancer in europe-west3, reserve a regional proxy-only subnet in the VPC, and attach a regional SSL certificate and regional URL map.: What a Regional external Application Load Balancer is A Regional external Application Load Balancer is a regional, proxy-based Layer 7 load balancer built on managed open-source Envoy proxies. It distributes external HTTP and HTTPS traffic to backend services situated in a single specific Google Cloud region while supporting advanced traffic management and security features. How it meets the requirements Jurisdictional compliance: Regional external Application Load Balancers guarantee that TLS termination occurs strictly within the designated Google Cloud region (europe-west3), ensuring complete compliance with data sovereignty and geographic isolation mandates. Application traffic management: Built-in Envoy-based Layer 7 capabilities allow advanced URL maps, path-based routing, header transformations, and weight-based canary traffic splitting without code modifications. Network perimeter isolation: Regional external Application Load Balancers deploy Envoy proxies directly into the customer's VPC network, requiring and utilizing an allocated proxy-only subnet (REGIONAL_MANAGED_PROXY) to connect to backend VMs. Key advantages Strict data residency: Guarantees that unencrypted plaintext payloads never leave the designated geographic boundary. Full Layer 7 feature parity: Supports URL rewrites, redirects, header manipulation, and granular routing rules. Consistent security integration: Seamlessly integrates with regional backend services, health checks, and regional Cloud Armor security policies. VPC isolation: Internal communication from the load balancer proxy to backend instances originates from a controlled, dedicated subnet range. Why this is optimal Compared to global load balancers, the regional external Application Load Balancer isolates all proxy execution, cryptographic operations, and Layer 7 processing to the specified region (europe-west3), perfectly aligning with regulatory mandates while providing complete HTTP(S) routing capabilities.

Regional External Application Load Balancer Jurisdiction | Professional Cloud Security Engineer

StudyCerts

Explanations

What a Regional external Application Load Balancer is

A Regional external Application Load Balancer is a regional, proxy-based Layer 7 load balancer built on managed open-source Envoy proxies. It distributes external HTTP and HTTPS traffic to backend services situated in a single specific Google Cloud region while supporting advanced traffic management and security features.

How it meets the requirements

Jurisdictional compliance: Regional external Application Load Balancers guarantee that TLS termination occurs strictly within the designated Google Cloud region (europe-west3), ensuring complete compliance with data sovereignty and geographic isolation mandates.
Application traffic management: Built-in Envoy-based Layer 7 capabilities allow advanced URL maps, path-based routing, header transformations, and weight-based canary traffic splitting without code modifications.
Network perimeter isolation: Regional external Application Load Balancers deploy Envoy proxies directly into the customer's VPC network, requiring and utilizing an allocated proxy-only subnet (REGIONAL_MANAGED_PROXY) to connect to backend VMs.

Key advantages

Strict data residency: Guarantees that unencrypted plaintext payloads never leave the designated geographic boundary.
Full Layer 7 feature parity: Supports URL rewrites, redirects, header manipulation, and granular routing rules.
Consistent security integration: Seamlessly integrates with regional backend services, health checks, and regional Cloud Armor security policies.
VPC isolation: Internal communication from the load balancer proxy to backend instances originates from a controlled, dedicated subnet range.

Why this is optimal

Compared to global load balancers, the regional external Application Load Balancer isolates all proxy execution, cryptographic operations, and Layer 7 processing to the specified region (europe-west3), perfectly aligning with regulatory mandates while providing complete HTTP(S) routing capabilities.

View source documentation

Professional Cloud Security Engineer

Regional External Application Load Balancer Jurisdiction