Quick Answer
The answer is 130.211.0.0/22 and 35.191.0.0/16. These two source IP ranges are the only ranges from which Google Cloud health check probes originate, so firewall rules must explicitly allow traffic from both to ensure load balancers can successfully verify backend instance health. On the Google Professional Cloud Network Engineer exam, this concept tests your understanding of how Google Cloud’s health checking system works at the network layer, often appearing in scenarios where you must configure ingress firewall rules for external or internal load balancers. A common trap is to allow only one range, especially 35.191.0.0/16, forgetting the legacy 130.211.0.0/22 range, which is still used by older load balancers and certain health check types. To remember both, think of the mnemonic “13 and 35” — the first two digits of each range — and note that 130.211 is the older, smaller block, while 35.191 is the newer, larger one covering /16.
This PCNE practice question tests your understanding of implementing network security. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A network engineer needs to configure firewall rules to allow health checks from Google Cloud's health check systems to a backend service. Which two source IP ranges should they allow? (Choose two.)
169.254.0.0/16
Why wrong: This is a link-local address, not used for health checks.
10.0.0.0/8
Why wrong: This is a private IP range, not used for health checks.
130.211.0.0/22
This is the other health check range.
35.191.0.0/16
This is one of the health check ranges.
0.0.0.0/0
Why wrong: This allows all traffic, overly permissive.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
130.211.0.0/22
Google Cloud health check probes originate from the specific IP ranges 130.211.0.0/22 and 35.191.0.0/16. Allowing these source ranges in firewall rules is necessary to permit health check traffic to reach backend instances, ensuring load balancers can determine instance health.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
169.254.0.0/16
Why it's wrong here
This is a link-local address, not used for health checks.
10.0.0.0/8
Why it's wrong here
This is a private IP range, not used for health checks.
130.211.0.0/22
Why this is correct
This is the other health check range.
Related concept
Read the scenario before looking for a memorised answer.
35.191.0.0/16
Why this is correct
This is one of the health check ranges.
Related concept
Read the scenario before looking for a memorised answer.
0.0.0.0/0
Why it's wrong here
This allows all traffic, overly permissive.
Common exam traps
Google Cloud often tests the misconception that health checks originate from the same subnet as the load balancer or from private IP ranges, leading candidates to incorrectly select 10.0.0.0/8 or 169.254.0.0/16 instead of the documented Google Cloud health check source ranges.
Detailed technical explanation
Google Cloud's HTTP(S), TCP/SSL, and UDP health checks use these two source ranges to probe backend instances. The ranges are documented in Google Cloud's firewall rules documentation and are globally consistent across all regions. In a real-world scenario, failing to allow both ranges can cause intermittent health check failures, leading to instances being marked unhealthy and traffic being disrupted, even if the application is functioning correctly.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
A healthcare organisation deploys an application with a public-facing web tier and a private database tier. The database subnet has no public IP and only accepts connections from the web tier's security group. Questions like this test whether you can design cloud network isolation using VNets/VPCs, subnets, and security group rules.
What to study next
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Implementing network security — study guide chapter
Learn the concepts, then practise the questions
Implementing network security practice questions
Targeted practice on this topic area only
All PCNE questions
497 questions across all exam domains
Google Professional Cloud Network Engineer study guide
Full concept coverage aligned to exam objectives
PCNE practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise PCNE questions linked to Designing, planning, and prototyping a GCP network.
Practise PCNE questions linked to Implementing hybrid interconnectivity.
Practise PCNE questions linked to Configuring network services.
Practise PCNE questions linked to Implementing network security.
Practise PCNE questions linked to Implementing a Virtual Private Cloud.
Practise PCNE questions linked to PCNE fundamentals.
Practise PCNE questions linked to PCNE scenario.
Practise PCNE questions linked to PCNE troubleshooting.
Practice this exam
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Implementing network security — This question tests Implementing network security — Read the scenario before looking for a memorised answer..
The correct answer is: 130.211.0.0/22 — Google Cloud health check probes originate from the specific IP ranges 130.211.0.0/22 and 35.191.0.0/16. Allowing these source ranges in firewall rules is necessary to permit health check traffic to reach backend instances, ensuring load balancers can determine instance health.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 30, 2026
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.