mediumMultiple ChoiceObjective-mapped
Google ACE Practice Question: A team deploys an application with sensitive…
A team deploys an application with sensitive internal APIs on GKE. The APIs should be reachable from other GKE services in the cluster and from on-premises systems via VPN, but not from the public internet. Which load balancer configuration meets this?
⚠ Common exam trap
Google Cloud often tests the misconception that a ClusterIP Service can be made externally accessible with an allowlist, but ClusterIP is strictly cluster-internal and cannot be reached from on-premises systems via VPN without additional components like a proxy or ingress.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Internal Application Load Balancer with a VPC-private IP
An Internal Application Load Balancer (HTTP/HTTPS) with a VPC-private IP is correct because it exposes the APIs only within the VPC network, making them reachable from other GKE services in the cluster and from on-premises systems via VPN (which extends the VPC), while blocking all public internet traffic by design. This load balancer operates at Layer 7 and uses an internal IP address that is not routable from the internet, satisfying the requirement without relying on additional access controls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Global external Application Load Balancer with Cloud Armor blocking non-VPN IPs
Why it's wrong here
A global external Application Load Balancer assigns a public anycast IP, so the API would be exposed to the internet even with Cloud Armor rules. Relying on Cloud Armor to block non-VPN IPs is fragile because allowlists can be misconfigured, IPs spoofed, or legitimate traffic inadvertently blocked, and it still requires maintaining public DNS and exposing a public endpoint. This does not meet the requirement of keeping the API internal to the VPC and on-premises network.
- ✓
Internal Application Load Balancer with a VPC-private IP
Why this is correct
An Internal Application Load Balancer receives a private RFC 1918 IP address from the VPC, making it reachable only from within the VPC or from connected networks via VPC peering, Cloud VPN, or Dedicated Interconnect. It never receives a public IP and can terminate HTTPS/HTTP traffic, apply managed SSL certificates, and route to backend services, providing a clean, fully private, and scalable endpoint for on-premises systems to consume an internal API.
- ✗
A ClusterIP Service with an external IP range allowlist
Why it's wrong here
A ClusterIP Service is only reachable from inside the Kubernetes cluster itself; it has no external IP and cannot be accessed from on-premises systems, even over VPN or Interconnect. An 'external IP range allowlist' is meaningless because ClusterIP Services never expose a routable IP outside the cluster, so this option fails to provide any connectivity path for internal corporate users.
- ✗
NodePort Service with VPC firewall rules restricting access to VPN IP ranges
Why it's wrong here
A NodePort Service publishes a high-numbered port on every node's external IP, which requires VPN clients to know and reach each node's IP directly. While VPC firewall rules can restrict source ranges to VPN IPs, this approach exposes the service on the raw node network, bypasses the benefit of a managed load balancer, and becomes operationally complex and non-scalable for an internal API used across many on-premises clients.
Go deeper
Related to this question
Learn chapter
GCP Database Services
Key term
VPC
A Virtual Private Cloud (VPC) is a logically isolated section of a cloud provider's network where you can launch and manage resources like servers and databases with complete control over IP addressing, subnets, route tables, and security.
Key term
VPN
A VPN (Virtual Private Network) creates a secure, encrypted tunnel between your device and a remote server, protecting your data and hiding your online activity.
About these practice questions
One of 769 original ACE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.