Google ACE Planning and Configuring a Cloud Solution Practice Question
A company is deploying a web application on Compute Engine and wants to distribute traffic across multiple instances in different zones for high availability. They also need to terminate SSL/TLS at the load balancer. Which TWO services should they use together?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Managed instance group
An external HTTP(S) load balancer provides SSL/TLS termination and distributes traffic across instances in multiple zones. Managed instance groups allow you to manage the instances and autoscale if needed. The load balancer uses the instance group as a backend.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Managed instance group
Why this is correct
A managed instance group (MIG) is the correct backend infrastructure because it maintains a pool of identical VM instances across multiple zones, enabling the HTTP(S) load balancer to distribute traffic and automatically heal failed instances. MIGs support autoscaling based on load, which is essential for a scalable web application, and they provide the instance-level health checking that the load balancer relies on to route requests only to healthy VMs.
- ✓
External HTTP(S) load balancer
Why this is correct
The external HTTP(S) load balancer is a correct companion component because it provides SSL/TLS termination and global cross-zone load balancing for the web application. It uses a global anycast IP and forwards requests to the managed instance group's backends, while also supporting features like URL mapping, CDN integration, and identity-aware proxy. This load balancer is the entry point for external client traffic and handles the cryptographic overhead of HTTPS away from your instances.
- ✗
Cloud CDN
Why it's wrong here
Cloud CDN is not required for basic load balancing and SSL termination because it is a content delivery network that caches static and dynamic content at Google's edge locations. While it can improve latency and reduce backend load, it does not perform load balancing or terminate SSL/TLS; those functions are handled by the external HTTP(S) load balancer. Adding Cloud CDN is an optimization, not a prerequisite for deploying a web application on Compute Engine.
- ✗
Internal TCP/UDP load balancer
Why it's wrong here
An internal TCP/UDP load balancer is incorrect because it is designed for private, internal traffic within a VPC network and does not terminate SSL/TLS. It is a regional, pass-through load balancer that forwards packets directly to backend instances without the ability to inspect or decrypt HTTPS traffic. Since the application is deployed to serve external users over the internet, an internal load balancer cannot provide the public entry point or SSL termination required.
- ✗
Cloud NAT
Why it's wrong here
Cloud NAT is incorrect because it is a managed network address translation service that enables instances without external IP addresses to make outbound internet connections. It does not provide inbound load balancing, SSL termination, or traffic distribution for a web application. Cloud NAT would only be relevant if your instances need to initiate outbound requests (e.g., to reach the internet for updates) while keeping them secure from direct inbound traffic.
Go deeper
Related to this question
Learn chapter
Google Compute Engine
Key term
High availability
High availability is a system design approach that aims to keep applications and services operational and accessible with minimal downtime, even when some components fail.
Key term
HTTP(S) Load Balancer
A network device or software that distributes incoming web traffic across multiple servers using HTTP or HTTPS protocols to ensure high availability, reliability, and performance.
About these practice questions
This ACE question is part of Courseiva's 769-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.