Question

A security engineer deploys an internal Application Load Balancer in front of a managed instance group of backend VMs in a custom-mode VPC. The backends have no external IPs. After deployment, all backends show as UNHEALTHY in the load balancer, and internal clients cannot reach the service. The default 'deny all ingress' behavior applies because no ingress allow rules exist for these VMs. Which action correctly restores health checks and traffic flow while following least-privilege principles?

Accepted Answer

Create an ingress allow firewall rule permitting traffic from the Google health check source ranges 130.211.0.0/22 and 35.191.0.0/16 to the backend VMs on the application ports, targeted by network tag or service account.

Answer

Assign external IP addresses to the backend VMs so Google health check probes can reach them over the internet.

Answer

Create an ingress allow firewall rule permitting 0.0.0.0/0 on all ports to the backend VMs to ensure both clients and probes can connect.

Answer

Enable Private Google Access on the backend subnet so the health check probes are routed privately to the instances.