Question

A retail company exposes a public web application through a Global External Application Load Balancer. Security review finds that clients can bypass the load balancer and reach the backend Compute Engine instances directly using their external IPs, avoiding Cloud Armor inspection. The security team must ensure that all traffic reaching the backends flows only through the load balancer, while keeping the application publicly reachable. Which combination of changes best enforces this?

Accepted Answer

Remove external IP addresses from the backend instances and create VPC ingress firewall rules that allow traffic only from the Google Front End (GFE) source ranges 130.211.0.0/22 and 35.191.0.0/16.

Answer

Attach a stricter Cloud Armor security policy to each backend instance individually so that direct client requests are blocked at the VM.

Answer

Enable VPC Service Controls around the project so external clients cannot reach the backend instances except through the load balancer.

Answer

Configure Cloud NAT for the backend subnet and rely on it to hide the instances from direct inbound client connections.