Google PCA Design and plan a cloud solution architecture Practice Question
A financial services firm is designing a new payment processing system on Google Cloud. The system must expose a single global anycast IP address, terminate TLS at the edge, and route requests to the nearest healthy backend across three regions. The backend services run on Compute Engine and must be protected from volumetric DDoS attacks. Which product should you place in front of the backends?
⚠ Common exam trap
Watch out — candidates often confuse Layer 4 network load balancing with Layer 7 application load balancing, and assuming Cloud Armor can attach to any load balancer type.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Global external Application Load Balancer with Cloud Armor security policies attached to the backend service.
A global external Application Load Balancer delivers a single global anycast IP, terminates TLS at Google's edge, and uses health-checked backends to route to the nearest region. Cloud Armor security policies attach to the backend service and provide DDoS and web application firewall protection. Regional load balancers cannot offer one global IP, and Layer 4 proxy or passthrough load balancers do not terminate HTTP(S) at the edge or support Cloud Armor in the required way.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Global external Proxy Network Load Balancer with Google Cloud Armor attached to the target proxy.
Why it's wrong here
The global external Proxy Network Load Balancer operates at Layer 4 for TCP or SSL traffic and does not terminate HTTP(S) at the edge for application-layer routing. Cloud Armor attaches to backend services of HTTP(S) load balancers, not to a target proxy in this way. This option fails because it lacks the HTTP-aware edge termination and the correct Cloud Armor integration point for the stated requirement.
- ✗
Regional external Application Load Balancer in each region with Cloud CDN enabled for caching.
Why it's wrong here
Regional external Application Load Balancers each have their own regional IP address, so they cannot present a single global anycast IP. Cloud CDN caches static content but does not provide the anycast global frontend or the required DDoS filtering for dynamic payment traffic. This option fails because it requires clients to choose a region and does not meet the single global IP requirement.
- ✗
External passthrough Network Load Balancer with a global forwarding rule and Cloud Armor on the backend.
Why it's wrong here
An external passthrough Network Load Balancer forwards packets without terminating TLS or inspecting HTTP, so it cannot terminate TLS at the edge. Cloud Armor does not attach to passthrough network load balancer backends. This option fails because it does not provide the required edge TLS termination, HTTP routing, or the supported Cloud Armor attachment point for DDoS mitigation.
- ✓
Global external Application Load Balancer with Cloud Armor security policies attached to the backend service.
Why this is correct
The global external Application Load Balancer provides a single global anycast IP, terminates TLS at Google's edge, and routes to the nearest healthy backend using the premium network tier. Cloud Armor attaches to the backend service to filter and absorb volumetric and application-layer attacks. This combination satisfies the anycast, TLS termination, cross-region routing, and DDoS protection requirements in one architecture.
Go deeper
Related to this question
Learn chapter
Security Best Practices and Compliance
Key term
IP address
An IP address is a unique numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication.
Key term
Load balancer
A load balancer is a device or software that distributes incoming network traffic across multiple servers so no single server gets overwhelmed.
About these practice questions
Courseiva writes every PCA question from scratch — 807 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Google Cloud exam blueprint
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.