Question

A financial services company runs several internal microservices in a Shared VPC. They want internal clients within the VPC to reach these microservices through a single internal IP address, with requests routed to different backend service groups based on the URL path (e.g., /payments, /accounts). Traffic must never traverse the public internet, and the solution must support HTTP-based Layer 7 path matching. Which load balancing configuration should the security engineer recommend?

Accepted Answer

Deploy an internal Application Load Balancer (regional internal HTTP(S) load balancer) with a URL map that routes paths to different backend services.

Answer

Deploy an internal passthrough Network Load Balancer with multiple backend services and forwarding rules per path.

Answer

Deploy a global external Application Load Balancer restricted with Cloud Armor and firewall rules to only accept internal ranges.

Answer

Deploy a proxy Network Load Balancer (internal TCP proxy) with a single backend service and rely on the microservices to route internally.