The correct choice is the Internal HTTP(S) Load Balancer because it provides cross-region internal HTTP load balancer VPC only functionality while remaining inaccessible from the public internet. This load balancer uses an internal IP address within your VPC and supports a multi-region backend service, allowing it to distribute traffic across Compute Engine instances in different regions while strictly enforcing VPC-only access. On the Google Professional Cloud Network Engineer exam, this scenario tests your understanding of the distinction between regional and global load balancers, as well as internal versus external access. A common trap is confusing the Internal HTTP(S) Load Balancer with the global External HTTP(S) Load Balancer, which requires public IPs and external connectivity. Remember the key differentiator: if the requirement specifies “internal only” and “cross-region,” the Internal HTTP(S) Load Balancer is the only option that combines an internal IP with global backend reach. For a quick memory tip, think “Internal = Private IP, Cross-Region = Global Backend Service.”
PCNE Configuring network services Practice Question
This PCNE practice question tests your understanding of configuring network services. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company is deploying an internal HTTP application on Compute Engine instances. The application must be load-balanced across multiple instances in different regions, but only accessible from within the same VPC. Which load balancer type meets these requirements?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Internal HTTP(S) Load Balancer
An Internal HTTP(S) Load Balancer is a regional, internal-only load balancer that distributes HTTP/HTTPS traffic among Compute Engine instances within the same VPC network. It uses an internal IP address and is not accessible from outside the VPC, meeting the requirement for internal-only access while providing cross-region load balancing via a multi-region backend service.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Internal HTTP(S) Load Balancer
Why this is correct
Internal HTTP(S) LB can be configured with backends in multiple regions and is internal to the VPC.
Related concept
Read the scenario before looking for a memorised answer.
✗
External TCP/UDP Load Balancer
Why it's wrong here
External TCP/UDP LB is public and not suitable for internal-only traffic.
✗
External HTTP(S) Load Balancer
Why it's wrong here
External HTTP(S) LB is internet-facing, not accessible only from within the VPC.
✗
Internal TCP/UDP Load Balancer
Why it's wrong here
Internal TCP/UDP LB does not support HTTP protocol; it's for TCP/UDP traffic.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Google Cloud often tests the misconception that any 'internal' load balancer can handle HTTP traffic, but the Internal TCP/UDP Load Balancer (option D) operates at layer 4 and cannot inspect or route HTTP application-layer data, making it unsuitable for an HTTP application.
Detailed technical explanation
How to think about this question
The Internal HTTP(S) Load Balancer operates at layer 7, using the Envoy proxy-based architecture to perform intelligent request routing based on URL paths, host headers, and other HTTP attributes. It supports cross-region load balancing by configuring a backend service with multiple instance groups in different regions, and it uses a single internal IP address (RFC 1918) that is globally accessible within the VPC via Google's Andromeda network virtualization stack. A subtle behavior is that the load balancer's health checks must originate from Google's internal health checker IP ranges, which are automatically allowed by VPC firewall rules when the load balancer is created.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Configuring network services — This question tests Configuring network services — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Internal HTTP(S) Load Balancer — An Internal HTTP(S) Load Balancer is a regional, internal-only load balancer that distributes HTTP/HTTPS traffic among Compute Engine instances within the same VPC network. It uses an internal IP address and is not accessible from outside the VPC, meeting the requirement for internal-only access while providing cross-region load balancing via a multi-region backend service.
What should I do if I get this PCNE question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.