An enterprise organization is deploying an internet-facing web service on Compute Engine instances in Google Cloud. The security and compliance teams have defined the following technical and architectural requirements: Jurisdictional compliance: Transport Layer Security (TLS) decryption and session termination must strictly occur within the europe-west3 region; terminating TLS at globally distributed edge points of presence (PoPs) is prohibited. Application traffic management: The load balancer must evaluate HTTP(S) request attributes to support URL path-based routing, header transformations, and percentage-based canary traffic splitting. Network perimeter isolation: Managed proxies handling the traffic must reside within the VPC network and draw IP addresses from a dedicated, reserved proxy-only subnet in the region. Which load balancing architecture should the security engineer deploy to satisfy all requirements?

Deploy a Regional external Application Load Balancer in europe-west3, reserve a regional proxy-only subnet in the VPC, and attach a regional SSL certificate and regional URL map.: What a Regional external Application Load Balancer is A Regional external Application Load Balancer is a regional, proxy-based Layer 7 load balancer built on managed open-source Envoy proxies. It distributes external HTTP and HTTPS traffic to backend services situated in a single specific Google Cloud region while supporting advanced traffic management and security features. How it meets the requirements Jurisdictional compliance: Regional external Application Load Balancers guarantee that TLS termination occurs strictly within the designated Google Cloud region (europe-west3), ensuring complete compliance with data sovereignty and geographic isolation mandates. Application traffic management: Built-in Envoy-based Layer 7 capabilities allow advanced URL maps, path-based routing, header transformations, and weight-based canary traffic splitting without code modifications. Network perimeter isolation: Regional external Application Load Balancers deploy Envoy proxies directly into the customer's VPC network, requiring and utilizing an allocated proxy-only subnet (REGIONAL_MANAGED_PROXY) to connect to backend VMs. Key advantages Strict data residency: Guarantees that unencrypted plaintext payloads never leave the designated geographic boundary. Full Layer 7 feature parity: Supports URL rewrites, redirects, header manipulation, and granular routing rules. Consistent security integration: Seamlessly integrates with regional backend services, health checks, and regional Cloud Armor security policies. VPC isolation: Internal communication from the load balancer proxy to backend instances originates from a controlled, dedicated subnet range. Why this is optimal Compared to global load balancers, the regional external Application Load Balancer isolates all proxy execution, cryptographic operations, and Layer 7 processing to the specified region (europe-west3), perfectly aligning with regulatory mandates while providing complete HTTP(S) routing capabilities.

Regional External Application Load Balancer Jurisdiction | Professional Cloud Security Engineer

AdvancedProfessional Cloud Security Engineer

An enterprise organization is designing a zero-trust network perimeter architecture for sensitive backend workloads hosted on Google Cloud Compute Engine instances across multiple VPC networks. The security engineering team has established the following technical requirements: Automatically block all inbound and outbound traffic associated with known malicious IP addresses and Tor exit nodes without maintaining static IP lists. Intercept and perform deep Layer 7 Intrusion Prevention System (IPS) inspection on encrypted TLS egress traffic to protect against malware, spyware, and command-and-control communication. Provide secure administrative SSH access to the instances without assigning external IP addresses or operating dedicated bastion hosts, while enforcing identity- and context-based access policies. Which combination of actions should the security team implement?

Configuring network perimeter controls (e.g., Cloud Next Generation Firewall [Cloud NGFW] rules and policies, Identity-Aware Proxy [IAP], load balancers, and Certificate Authority Service).

AdvancedProfessional Cloud Security Engineer

An enterprise is designing a secure three-tier application architecture on Google Cloud across isolated VPC networks for the presentation tier, business logic tier, and database tier. The security team establishes the following boundary isolation requirements: The business logic tier must privately publish microservices to the presentation VPC without creating transitive routing risks, shared IP address spaces, or VPC Network Peering mesh dependencies. Compute Engine instances in the backend tiers must communicate with Google APIs (such as Cloud Storage and BigQuery) privately without public IP addresses or internet egress. Layer 7 traffic routing, path-based URL directing, and TLS termination for internal microservices within a VPC must be fully managed with private addressing. Which combination of network isolation and data encapsulation controls should you deploy?

Configuring network isolation and data encapsulation for N-tier applications.

AdvancedProfessional Cloud Security Engineer

An enterprise has enabled Cloud Next Generation Firewall (Cloud NGFW) Enterprise with Intrusion Detection and Prevention Service (IDPS) in a global network firewall policy. A security engineer is investigating a potential command-and-control communication attempt targeting an internal Compute Engine workload. The engineer needs to query Cloud Logging to locate the Layer 7 threat detection record generated by the firewall endpoint and correlate it with the firewall policy rule execution. Which query strategy and log structure should the security engineer use in Cloud Logging to analyze both events?

Configuring and analyzing network logs (Cloud Next Generation Firewall [Cloud NGFW], VPC flow logs, Packet Mirroring, Cloud Intrusion Detection System [Cloud IDS], Log Analytics).

AdvancedProfessional Cloud Security Engineer

An enterprise organization is designing a separation of duties (SoD) framework across multiple Google Cloud projects protected by VPC Service Controls (VPC SC) perimeters. The security team wants to define role-based ingress and egress rules to allow developers to perform specific operations across perimeters while strictly isolating administrative privilege assignment and preventing unauthorized cross-perimeter IAM modifications. Which constraint or limitation regarding role-based ingress and egress rules must the security team account for when architecting this separation of duties model?

Managing privileged roles and separation of duties with Identity and Access Management (IAM) roles and permissions.

AdvancedProfessional Cloud Security Engineer

An enterprise organization is hardening its Google Cloud and Cloud Identity access governance model. A security audit reveals that several administrators hold permanent Super Admin privileges for day-to-day administrative tasks, creating critical risks of configuration tampering, accidental service disruption, and broad privilege abuse. The security team must implement a robust access control architecture meeting these requirements: Eliminate standing super administrator assignments by enforcing least privilege and separation of duties for daily operations. Provide an audited break-glass emergency procedure for critical Cloud Identity recovery scenarios with controls to prevent unilateral unauthorized activation. Provide time-bound, just-in-time (JIT) privilege elevation with mandatory business justifications and audit logging for sensitive infrastructure administration. Which set of controls should the organization implement?

Managing a super administrator account.

AdvancedProfessional Cloud DevOps Engineer

Your enterprise operates a hybrid cloud architecture comprising Google Cloud workloads and critical on-premises database clusters (such as Cassandra and Elasticsearch). You have been tasked with centralizing infrastructure and database metrics into Google Cloud Monitoring without modifying underlying application code. After deploying BindPlane to collect telemetry from your on-premises servers, you observe that the volume of ingested metric data in Cloud Monitoring is exceeding budget thresholds. Your monitoring policy only requires performance metrics at a 5-minute granularity for standard operational dashboards, and several default component metrics are unnecessary for your operational alerting. What should you do to optimize your hybrid metric pipeline and reduce ingestion costs?

Collecting metrics (e.g., from applications, platforms, networking, Cloud Service Mesh, Google Cloud Managed Service for Prometheus, hybrid/multi-cloud environments)

Professional Cloud Security Engineer

Regional External Application Load Balancer Jurisdiction

Related questions

Professional Cloud Security Engineer

Regional External Application Load Balancer Jurisdiction

What a Regional external Application Load Balancer is

How it meets the requirements

Key advantages

Why this is optimal

Related questions

What a Regional external Application Load Balancer is

How it meets the requirements

Key advantages

Why this is optimal