← PCNE·Google Cloud

Question 41 of 1,000

mediumMultiple ChoiceObjective-mapped

Configuring Firewall Rules for Internal Load Balancer Health Checks

This PCNE practice question tests your understanding of pcne exam topics. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

Your organization has an internal HTTP load balancer (ILB) in us-central1. The backend service is a managed instance group with a health check on port 8080. Recently, some instances are reported as unhealthy despite the application running fine. What is the most likely cause?

Clue words in this question

Noticing these words before you look at the options changes how you read each choice.

Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.

A
The health check firewall rule is configured for the same source range as the VPC internal traffic.
Why wrong: Incorrect. The firewall rule for health checks must allow traffic from Google's health check IP ranges (e.g., 35.191.0.0/16), not just VPC internal traffic.
B
The internal load balancer is using a proxy protocol which changes the health check source IP.
Why wrong: Incorrect. The internal load balancer does not use proxy protocol; health check probes come directly from Google's health check systems with their own source IPs.
C
The firewall rule allowing health check probes does not include the required source IP ranges (e.g., 35.191.0.0/16).
Correct. Health check probes originate from Google's IP ranges (35.191.0.0/16, 130.211.0.0/22). If these are not allowed in the firewall rule, health checks fail.
D
The instances are preemptible and become unhealthy after 24 hours.
Why wrong: Incorrect. Preemptible instances can pass health checks as long as the application is running; preemptibility does not directly cause unhealthy status.

Full breakdown with real-world context →

Quick Answer

The answer is a missing or misconfigured firewall rule that does not include the required health check source IP ranges, specifically 35.191.0.0/16 and 130.211.0.0/22. When configuring an internal load balancer health check firewall, GCP probes originate from these external ranges, not from within the VPC, so the firewall must explicitly allow ingress on the health check port (8080) from those IPs. If the rule only permits traffic from internal VPC subnets, the health checks will fail even though the application is running fine. This scenario tests your understanding of the Google Professional Cloud Network Engineer exam’s focus on separating health check firewall rules from general internal traffic—a common trap where engineers assume health check probes come from the same network as the backend. A reliable memory tip is “Health checks come from Google’s cloud, not your VPC,” so always verify the source ranges in your firewall rules.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The firewall rule allowing health check probes does not include the required source IP ranges (e.g., 35.191.0.0/16).

The most likely cause is that the firewall rule allowing health check probes does not include the required Google Cloud health check source IP ranges (35.191.0.0/16 and 130.211.0.0/22). For internal HTTP load balancers, the health check probes originate from these specific ranges, not from within the VPC. If the firewall rule only permits traffic from the VPC internal ranges, health checks will fail even if the application is running. Option A is wrong because the health check source range is not the same as VPC internal traffic; it must be the GCP health check ranges. Option B is wrong because proxy protocol does not affect health check source IPs for internal load balancers. Option D is wrong because preemptible instances do not become unhealthy after 24 hours due to preemption; they are terminated, not marked unhealthy.

Key principle: ACLs process entries top to bottom and stop at the first match. Entry order and interface direction matter as much as the permit or deny statement.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The health check firewall rule is configured for the same source range as the VPC internal traffic.
Why it's wrong here
Incorrect. The firewall rule for health checks must allow traffic from Google's health check IP ranges (e.g., 35.191.0.0/16), not just VPC internal traffic.
✗
The internal load balancer is using a proxy protocol which changes the health check source IP.
Why it's wrong here
Incorrect. The internal load balancer does not use proxy protocol; health check probes come directly from Google's health check systems with their own source IPs.
✓
The firewall rule allowing health check probes does not include the required source IP ranges (e.g., 35.191.0.0/16).
Why this is correct
Correct. Health check probes originate from Google's IP ranges (35.191.0.0/16, 130.211.0.0/22). If these are not allowed in the firewall rule, health checks fail.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Standard ACLs match source addresses.
✗
The instances are preemptible and become unhealthy after 24 hours.
Why it's wrong here
Incorrect. Preemptible instances can pass health checks as long as the application is running; preemptibility does not directly cause unhealthy status.

Common exam traps

Common exam trap: ACLs stop at the first match

ACLs are processed top to bottom. The first matching entry wins, and an implicit deny usually exists at the end.

Detailed technical explanation

How to think about this question

ACL questions test precision: source, destination, protocol, port and direction. A generally correct ACL can still fail if it is applied on the wrong interface or in the wrong direction.

KKey Concepts to Remember

Standard ACLs match source addresses.
Extended ACLs can match source, destination, protocol and ports.
The first matching ACL entry is used.
There is usually an implicit deny at the end.

TExam Day Tips

Check inbound versus outbound direction.
Read the ACL from top to bottom.
Look for a broader permit or deny above the intended line.

Key takeaway

ACLs process entries top to bottom and stop at the first match. Entry order and interface direction matter as much as the permit or deny statement.

Real-world example

How this comes up in practice

A healthcare organisation deploys an application with a public-facing web tier and a private database tier. The database subnet has no public IP and only accepts connections from the web tier's security group. Questions like this test whether you can design cloud network isolation using VNets/VPCs, subnets, and security group rules.

What to study next

Got this wrong? Here's your next step.

Review ACL processing order, placement rules (standard near destination, extended near source), and inbound vs outbound direction. Study wildcard masks and implicit deny. Then practise related PCNE ACL questions on filtering logic and placement.

Related PCNE practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Configuring Network Services practice questions

Practise PCNE questions linked to Configuring Network Services.

Implementing Hybrid Interconnectivity practice questions

Practise PCNE questions linked to Implementing Hybrid Interconnectivity.

Managing, Monitoring, and Optimising Network Operations practice questions

Practise PCNE questions linked to Managing, Monitoring, and Optimising Network Operations.

Designing, Planning, and Prototyping a GCP Network practice questions

Practise PCNE questions linked to Designing, Planning, and Prototyping a GCP Network.

Implementing VPC Instances practice questions

Practise PCNE questions linked to Implementing VPC Instances.

Implementing network security practice questions

Practise PCNE questions linked to Implementing network security.

Implementing a Virtual Private Cloud practice questions

Practise PCNE questions linked to Implementing a Virtual Private Cloud.

PCNE fundamentals practice questions

Practise PCNE questions linked to PCNE fundamentals.

PCNE scenario practice questions

Practise PCNE questions linked to PCNE scenario.

PCNE troubleshooting practice questions

Practise PCNE questions linked to PCNE troubleshooting.

Practice this exam

Start a free PCNE practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

PCNE practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this PCNE question test?

Standard ACLs match source addresses.

What is the correct answer to this question?

The correct answer is: The firewall rule allowing health check probes does not include the required source IP ranges (e.g., 35.191.0.0/16). — The most likely cause is that the firewall rule allowing health check probes does not include the required Google Cloud health check source IP ranges (35.191.0.0/16 and 130.211.0.0/22). For internal HTTP load balancers, the health check probes originate from these specific ranges, not from within the VPC. If the firewall rule only permits traffic from the VPC internal ranges, health checks will fail even if the application is running. Option A is wrong because the health check source range is not the same as VPC internal traffic; it must be the GCP health check ranges. Option B is wrong because proxy protocol does not affect health check source IPs for internal load balancers. Option D is wrong because preemptible instances do not become unhealthy after 24 hours due to preemption; they are terminated, not marked unhealthy.

What should I do if I get this PCNE question wrong?

Are there clue words in this question I should notice?

Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.

What is the key concept behind this question?

Standard ACLs match source addresses.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

1 more ways this is tested on PCNE

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. A company has deployed an HTTP load balancer with a backend service configured to use an unmanaged instance group. Users report that traffic is not reaching the backend instances. The backend instances are healthy and have proper firewall rules allowing traffic from the load balancer. What step should the network engineer take to resolve the issue?

easy

✓ A.Configure a firewall rule to allow health check probes from the load balancer's health check ranges.
B.Enable HTTP health check on the backend service.
C.Assign an external IP address to each backend instance.
D.Add a route for the load balancer's IP range.

Why A: The issue is that health check probes are being blocked by firewall rules. For the load balancer to consider backend instances healthy, it must be able to send health check probes to them. These probes originate from specific IP ranges (e.g., 130.211.0.0/22 and 35.191.0.0/16 for Google Cloud). A firewall rule must allow ingress traffic from these health check ranges to the instances. Option A corrects this. Option B is not needed because an HTTP health check is already configured as part of the backend service (the load balancer performs health checks by default). Option C is not required because backend instances can have only internal IPs; the load balancer forwards traffic to them using their internal IPs. Option D is unnecessary because the load balancer's VIP is not used as a destination for traffic from the load balancer to instances.

Keep practising

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.