Google PCA Manage implementation of cloud architecture Practice Question
A multinational corporation has deployed a web application across multiple Google Cloud regions using an external HTTPS load balancer with backend services in each region. They recently added a new region (asia-southeast1) and updated the load balancer configuration. After the update, some users in that region report high latency and occasional connection timeouts when accessing the application. The load balancer health checks show all backends as healthy. The network team confirms that the backend instances in asia-southeast1 are correctly configured and can be accessed directly via their external IPs. What should the architects investigate next?
⚠ Common exam trap
Google Cloud often tests the misconception that health check success implies full end-to-end connectivity, but health checks bypass Cloud Armor and firewall rules that apply to user traffic, so healthy backends do not guarantee user traffic is allowed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Review the Cloud Armor security policy rules that might be blocking traffic from that region
Cloud Armor security policies can block traffic based on geographic location. If the new region (asia-southeast1) was added but the Cloud Armor policy was not updated to allow traffic from that region, requests from users in asia-southeast1 could be denied or rate-limited, causing high latency and timeouts even though health checks (which originate from Google's health check ranges, not user IPs) show backends as healthy. The direct access via external IPs works because it bypasses the load balancer and its associated Cloud Armor policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Check the Cloud CDN cache settings for the new region
Why it's wrong here
Cloud CDN does not cause timeouts for dynamic requests.
- ✗
Verify that the backend service in asia-southeast1 has the correct timeout settings for the load balancer
Why it's wrong here
Timeout settings are global; would affect all regions.
- ✗
Ensure that the firewall rules allow traffic from the load balancer's health check ranges to the instances
Why it's wrong here
Health checks are healthy, so firewall for health checks is not the issue.
- ✓
Review the Cloud Armor security policy rules that might be blocking traffic from that region
Why this is correct
Cloud Armor geo-filtering may block traffic from that region while allowing health checks from Google IPs.
Go deeper
Related to this question
Learn chapter
Introduction to Google Cloud Platform
Key term
CAN
A CAN (Controller Area Network) is a robust vehicle bus standard designed to allow microcontrollers and devices to communicate with each other without a host computer.
Key term
Latency
Latency is the time delay between a request being sent over a network and the response being received, often measured in milliseconds.
About these practice questions
This PCA question is part of Courseiva's 955-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.