Question 41 of 961
Configuring Firewall Rules for Internal Load Balancer Health Checks
Your organization has an internal HTTP load balancer (ILB) in us-central1. The backend service is a managed instance group with a health check on port 8080. Recently, some instances are reported as unhealthy despite the application running fine. What is the most likely cause?
Quick Answer
The answer is a missing or misconfigured firewall rule that does not include the required health check source IP ranges, specifically 35.191.0.0/16 and 130.211.0.0/22. When configuring an internal load balancer health check firewall, GCP probes originate from these external ranges, not from within the VPC, so the firewall must explicitly allow ingress on the health check port (8080) from those IPs. If the rule only permits traffic from internal VPC subnets, the health checks will fail even though the application is running fine. This scenario tests your understanding of the Google Professional Cloud Network Engineer exam’s focus on separating health check firewall rules from general internal traffic—a common trap where engineers assume health check probes come from the same network as the backend. A reliable memory tip is “Health checks come from Google’s cloud, not your VPC,” so always verify the source ranges in your firewall rules.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The firewall rule allowing health check probes does not include the required source IP ranges (e.g., 35.191.0.0/16).
The most likely cause is that the firewall rule allowing health check probes does not include the required Google Cloud health check source IP ranges (35.191.0.0/16 and 130.211.0.0/22). For internal HTTP load balancers, the health check probes originate from these specific ranges, not from within the VPC. If the firewall rule only permits traffic from the VPC internal ranges, health checks will fail even if the application is running. Option A is wrong because the health check source range is not the same as VPC internal traffic; it must be the GCP health check ranges. Option B is wrong because proxy protocol does not affect health check source IPs for internal load balancers. Option D is wrong because preemptible instances do not become unhealthy after 24 hours due to preemption; they are terminated, not marked unhealthy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The health check firewall rule is configured for the same source range as the VPC internal traffic.
Why it's wrong here
Incorrect. The firewall rule for health checks must allow traffic from Google's health check IP ranges (e.g., 35.191.0.0/16), not just VPC internal traffic.
- ✗
The internal load balancer is using a proxy protocol which changes the health check source IP.
Why it's wrong here
Incorrect. The internal load balancer does not use proxy protocol; health check probes come directly from Google's health check systems with their own source IPs.
- ✓
The firewall rule allowing health check probes does not include the required source IP ranges (e.g., 35.191.0.0/16).
Why this is correct
Correct. Health check probes originate from Google's IP ranges (35.191.0.0/16, 130.211.0.0/22). If these are not allowed in the firewall rule, health checks fail.
- ✗
The instances are preemptible and become unhealthy after 24 hours.
Why it's wrong here
Incorrect. Preemptible instances can pass health checks as long as the application is running; preemptibility does not directly cause unhealthy status.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on PCNE
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has deployed an HTTP load balancer with a backend service configured to use an unmanaged instance group. Users report that traffic is not reaching the backend instances. The backend instances are healthy and have proper firewall rules allowing traffic from the load balancer. What step should the network engineer take to resolve the issue?
easy- A.Configure a firewall rule to allow health check probes from the load balancer's health check ranges.
- B.Enable HTTP health check on the backend service.
- C.Assign an external IP address to each backend instance.
- ✓ D.Add a route for the load balancer's IP range.
Why D: The load balancer sends traffic to backend instances using their internal IP addresses. If there is no route from the load balancer's frontend IP range to the subnet containing the backend instances, traffic will be dropped. Adding a route for the load balancer's IP range ensures that packets can reach the instances. Since the problem states firewall rules are already proper, Option A (health check firewall rules) is unnecessary. Health checks are already configured (Option B is not needed). Instances do not require external IPs (Option C). Therefore, the correct step is to add the missing route.
Last reviewed: Jun 24, 2026
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.