easyMultiple ChoiceObjective-mapped
Google ACE Practice Question: A load balancer is routing traffic to a VM where…
A load balancer is routing traffic to a VM where the application process has crashed, but the VM itself is still running. What prevents the load balancer from continuing to send traffic to this instance?
⚠ Common exam trap
It's easy for candidates to confuse infrastructure-level health (VM running) with application-level health (process responding), and assume autoscaling or firewall rules handle this, when in fact only a properly configured health check can detect a crashed application process.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An HTTP health check configured on the backend service
The load balancer uses an HTTP health check to periodically probe the application on the VM. When the application process crashes, the health check fails (e.g., returns a non-2xx status code or times out), and the load balancer automatically stops routing new traffic to that unhealthy instance. This is the standard mechanism in Google Cloud for detecting application-level failures, as opposed to infrastructure-level failures.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A VPC firewall rule blocking traffic to the VM
Why it's wrong here
VPC firewall rules are static packet filters applied at the network layer for both ingress and egress traffic, based on direction, protocol, port, and source/target IP ranges. A firewall rule blocking the VM would indiscriminately prevent all traffic to that instance, including health check probes, and would require manual or separate automation to change when an application crashes. Firewalls cannot detect application-level failures or dynamically reroute traffic around a single unhealthy VM within an instance group.
- ✓
An HTTP health check configured on the backend service
Why this is correct
An HTTP health check configured on the backend service is the mechanism that actively probes each VM's application port (for example, /healthz) over HTTP. When the application crashes and fails to return a 200 OK response within the set thresholds, the load balancer marks that instance as UNHEALTHY, removes it from active service, and stops forwarding new requests to it until the health check succeeds again. This is exactly how Google Cloud load balancers perform per-instance liveness detection and is the correct reason traffic stops.
- ✗
A Cloud Armor security policy blocking the crashed instance's IP
Why it's wrong here
Cloud Armor policies filter incoming client traffic at the edge of Google Cloud based on attributes like source IP, geolocation, or OWASP attack signatures. They do not probe backend instance health or inspect the internal state of VMs, and a crashed application's IP is generally an internal address invisible to Cloud Armor. Thus, while Cloud Armor protects against malicious client requests, it cannot dynamically remove an unhealthy instance from a load balancer's backend pool.
- ✗
The instance group autoscaling policy detecting the failure
Why it's wrong here
The instance group autoscaling policy adjusts the number of VMs based on aggregate metrics such as CPU utilization, requests per second, or custom metrics. It does not directly control per-instance traffic routing: the load balancer stops sending requests to a specific VM only when a backend health check marks that VM as unhealthy. Autoscaling may eventually replace or delete an unhealthy instance, but that is a secondary effect, and the immediate reason traffic stops is the health check, not the autoscaler itself.
Go deeper
Related to this question
About these practice questions
One of 769 original ACE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.