PCNE Implementing network security Practice Question
A company has deployed a globally distributed application on Google Cloud using Cloud Load Balancing and managed instance groups across multiple regions. They need to restrict access to the application's backend instances so that only traffic from the load balancer's health check ranges and the load balancer's source IP addresses is allowed. Which firewall rule configuration should be used?
⚠ Common exam trap
Google Cloud often tests the misconception that you can simply allow the load balancer's frontend IP address, but the trap here is that the frontend IP is a virtual IP that never appears as the source IP in packets reaching the backend—instead, the source IP is the load balancer's internal IP or health check ranges, so candidates must understand the difference between frontend and backend traffic flows.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an ingress firewall rule that allows traffic from the load balancer's health check ranges and uses a service account filter to allow traffic from the cloud-services service account (used by the load balancer).
It uses a service account filter to allow traffic from the cloud-services service account, which is the identity used by Cloud Load Balancing to forward traffic to backend instances. This ensures that only traffic originating from the load balancer (including health check probes) is permitted, while also automatically covering the health check ranges (35.191.0.0/16, 130.211.0.0/22) without needing to hardcode IP ranges. This approach is more secure and scalable than IP-based rules, as it avoids the risk of IP range changes and provides identity-based access control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create an ingress firewall rule that allows traffic from the load balancer's health check ranges and uses a service account filter to allow traffic from the cloud-services service account (used by the load balancer).
Why this is correct
This ensures that only traffic from the load balancer's health check probes and the load balancer itself (via service account) reaches the backend instances.
- ✗
Create an ingress firewall rule allowing all traffic from 0.0.0.0/0 with a target tag applied to the backend instances.
Why it's wrong here
This would allow traffic from any source, not just the load balancer, exposing the instances.
- ✗
Create an ingress firewall rule that denies all traffic except from the load balancer's frontend IP address.
Why it's wrong here
The load balancer's frontend IP is a virtual IP and does not appear as the source IP in packets reaching the backend; this would not work.
- ✗
Create an ingress firewall rule allowing traffic from the health check ranges (35.191.0.0/16, 130.211.0.0/22) and the load balancer's source IP ranges (e.g., 130.211.0.0/22) to the backend instances.
Why it's wrong here
This approach is not recommended because the load balancer's source IP ranges can vary and are not guaranteed; using service account filters is more reliable.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every PCNE question from scratch — 961 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.