Question 1

What load balancer types does GCP offer?

Accepted Answer

They divide along three axes: external versus internal, application (layer 7, proxy) versus network (layer 4), and global versus regional. So the main options are the global external Application Load Balancer, regional external Application Load Balancer, internal Application Load Balancer, external passthrough Network Load Balancer, internal passthrough Network Load Balancer, and external proxy Network Load Balancer for TCP and SSL. The framing that makes this memorable is to answer the three questions in order — is the traffic from the internet or internal, do you need HTTP-aware routing, and does it need to be global — because those three answers uniquely select a product.

Question 2

What is the difference between a proxy and a passthrough load balancer?

Accepted Answer

A proxy load balancer terminates the client connection and opens a new one to the backend, so it can inspect and modify HTTP, apply TLS termination, route by path or header, and add CDN and WAF. A passthrough load balancer forwards packets to the backend without terminating, so the backend sees the original client IP and any protocol works, but no layer 7 features are available. The consequence to name is source IP: with a proxy, the backend sees the load balancer's IP and must read X-Forwarded-For; with passthrough it sees the real client. That difference bites when someone implements IP-based rate limiting behind a proxy and blocks everyone.

Question 3

Walk through the components of a global external Application Load Balancer.

Accepted Answer

A global forwarding rule binds the anycast IP and port to a target HTTP or HTTPS proxy. The proxy holds the SSL certificates and references a URL map, which routes by host and path to backend services or backend buckets. Each backend service defines its backends — instance groups or network endpoint groups — a health check, a balancing mode and capacity, and optionally Cloud CDN and a Cloud Armor policy. Being able to recite that chain in order is a reliable indicator of having actually built one, because the objects are not obvious from the console. It also makes troubleshooting straightforward, since a 502 can be traced to a specific link in the chain.

Question 4

How does the global load balancer route a user to a backend?

Accepted Answer

The anycast IP is announced from Google edge locations worldwide, so the user's traffic enters at the nearest point of presence. From there it travels Google's private backbone to the closest region that has healthy backends with available capacity, spilling over to the next region when a region is at its configured capacity or unhealthy. The capacity-based spillover is the part that only works if you configured the balancing mode and maximum rate or utilisation correctly. Without meaningful capacity settings, the load balancer cannot know a region is full, so "global failover" silently does not happen.

Question 5

What are health checks and what happens when they fail?

Accepted Answer

A health check probes each backend at an interval with a configured protocol, port and path, and marks it healthy or unhealthy after a threshold of consecutive successes or failures. Unhealthy backends stop receiving traffic. If every backend in a group is unhealthy, the load balancer returns an error, and with managed instance group autohealing the instance is recreated. Two practical points: the probe must be allowed through the firewall from 130.211.0.0/22 and 35.191.0.0/16, and the check path should exercise the application rather than returning a static 200 — a health check that always passes is worse than none because it hides real failures.

Question 6

What is the difference between a load balancer health check and MIG autohealing?

Accepted Answer

A load-balancing health check only decides whether to send traffic to a backend. An autohealing health check on a managed instance group recreates the instance when it fails. They are configured separately and can use different checks — autohealing should be more conservative, because recreating an instance is destructive. The failure to warn about is an autohealing check with too short an initial delay, which kills instances before the application finishes starting and puts the group into a recreate loop. That is a classic outage that looks like an application crash and is actually configuration.

Question 7

What is a balancing mode and why does it matter?

Accepted Answer

The balancing mode defines how a backend's capacity is measured — RATE (requests per second per instance or endpoint), UTILIZATION (backend CPU), or CONNECTION for layer 4. Together with the capacity scaler it tells the load balancer when a backend group is full, which drives overflow to other zones or regions. RATE with a realistic maximum is generally preferred for HTTP because it is a direct measure of load, whereas CPU utilisation is an indirect proxy that lags. The capacity scaler is also the mechanism for gracefully draining a region — set it towards zero and traffic shifts away.

Question 8

What is connection draining?

Accepted Answer

Connection draining lets in-flight requests complete when a backend is removed from a group or marked unhealthy, instead of cutting connections immediately. You configure a draining timeout on the backend service, during which the backend receives no new requests but finishes existing ones. It is what makes scale-in and rolling updates invisible to users, and it must be paired with the application handling SIGTERM properly. A short drain timeout with long-running requests still drops connections, so the timeout should exceed your longest normal request.

Question 9

What is session affinity and when would you use it?

Accepted Answer

Session affinity routes requests from the same client to the same backend, based on client IP, a generated cookie, a header, or an HTTP cookie you name. It is used for applications holding in-memory session state or a local cache, and it weakens even load distribution. The recommendation is to design stateless services and externalise session state, treating affinity as an optimisation rather than a correctness requirement. Affinity is also best-effort — a backend removal breaks it — so an application that depends on it will fail during any scaling event.

Question 10

What is Cloud CDN and how does caching work?

Accepted Answer

Cloud CDN caches content at Google edge locations, enabled per backend service or backend bucket on an Application Load Balancer. Cacheability is driven by origin Cache-Control headers by default, with cache modes to force caching of static content, plus negative caching for error responses and signed URLs or cookies for private content. Cache-Control on the origin is the lever that determines hit rate, and it is where most poor CDN performance originates. Naming cache keys — which query parameters and headers form the key — is the other important control, because an unnecessary parameter in the key fragments the cache.

Question 11

How do you invalidate CDN content, and what is the better approach?

Accepted Answer

Invalidation is issued per URL or path pattern and propagates within minutes, but it is rate-limited and should be used sparingly. The better approach is versioned or content-hashed URLs, so a new deployment references a new path and the old objects simply expire — no invalidation needed. Relying on invalidation as the normal release mechanism is a design smell, because it is slow, limited and a single point of failure in the deploy. Content-hashed asset filenames make cache correctness automatic, which is why every modern build tool produces them.

Question 12

What is a cache key and why does it matter?

Accepted Answer

The cache key determines what counts as the same object — by default the full URI including query parameters, and optionally selected headers, cookies or the protocol. Including unnecessary components fragments the cache, lowering hit rate; excluding necessary ones can serve the wrong content to a user. The classic problem is analytics or tracking query parameters that do not change the response but create a distinct cache entry per user. Excluding them from the cache key can transform hit rate, and that is a concrete, measurable optimisation worth naming.

Question 13

How do you serve private content through Cloud CDN?

Accepted Answer

Signed URLs for individual objects with a short expiry, or signed cookies when a client fetches many related objects such as video segments — you sign once and the cookie authorises the whole path prefix. For internal corporate applications, Identity-Aware Proxy in front of the load balancer authorises by Google identity instead. Signed cookies rather than signed URLs is the right answer for streaming, because signing every segment URL is impractical and breaks player behaviour. Knowing which mechanism suits which access pattern is what the question is testing.

Question 14

How does SSL/TLS work on a GCP load balancer?

Accepted Answer

The target HTTPS proxy holds one or more SSL certificates — Google-managed, which are provisioned and renewed automatically after domain validation, or self-managed ones you upload. An SSL policy controls minimum TLS version and cipher suites. Traffic to backends can be re-encrypted or sent over HTTP inside the VPC depending on your requirements. The provisioning gotcha to name is that a Google-managed certificate stays in PROVISIONING until DNS resolves the domain to the load balancer IP, because validation requires it. That ordering dependency causes real launch delays when people configure DNS last.

Question 15

What is an SSL policy and what would you set?

Accepted Answer

An SSL policy defines the minimum TLS version and the permitted cipher suites for a load balancer. A sensible production setting is a minimum of TLS 1.2 with the RESTRICTED or MODERN profile, moving to TLS 1.3 where client compatibility allows, rather than leaving the permissive default. The trade-off is client compatibility — very old clients fail with a restrictive policy — so the decision depends on your audience. Being able to state that trade-off, rather than recommending maximum strictness unconditionally, is what makes the answer practical.

Question 16

What is Cloud DNS and what makes it different from running your own?

Accepted Answer

Cloud DNS is a managed authoritative DNS service running on Google's anycast name servers with a 100% availability SLA. It supports public zones, private zones scoped to specific VPCs, DNS forwarding to on-premises resolvers, DNS peering between VPCs, DNSSEC, and routing policies such as geolocation and weighted round robin. The 100% SLA is genuinely unusual and worth naming. The private-zone and forwarding features are what make it work in an enterprise hybrid setup, where internal names must resolve consistently from both cloud and on-premises.

Question 17

What are Cloud DNS routing policies?

Accepted Answer

Routing policies return different answers based on conditions: weighted round robin for splitting traffic by percentage, geolocation for directing users to a regional endpoint, and failover with health checks for active-passive setups. They allow DNS-level traffic management without a load balancer. The caveat that matters is DNS caching: clients and resolvers cache answers for the TTL, so DNS-based failover is slower and less reliable than anycast failover at a global load balancer. Preferring the load balancer where possible, and reserving DNS policies for cases it cannot cover, is the correct position.

Question 18

When would you use a regional rather than a global external Application Load Balancer?

Accepted Answer

When traffic must stay within a region for data residency or regulatory reasons; when you need features available only in the regional product; or when the workload is genuinely single-region and you prefer regional failure isolation. Otherwise the global load balancer is the default because of anycast, global capacity spillover and a single IP. Data residency is the most common genuine driver. Choosing regional simply because the application is currently in one region forfeits the ability to add another region later without changing the entry point, which is worth pointing out.

Question 19

What is an internal load balancer used for?

Accepted Answer

Distributing traffic between tiers inside the VPC — a frontend calling a backend service, or microservices calling each other — with a private IP not reachable from the internet. The internal passthrough Network Load Balancer works at layer 4 and preserves client IP; the internal Application Load Balancer adds HTTP routing, header-based rules and traffic splitting. The internal Application Load Balancer supporting traffic splitting is the useful detail, because it enables canary releases between internal services without a service mesh. That is a lighter-weight alternative worth knowing for teams that do not want mesh complexity.

Question 20

What is a backend bucket?

Accepted Answer

A backend bucket lets a Cloud Storage bucket serve as a backend for an Application Load Balancer, so static content is served under your own domain with your certificate and can be cached by Cloud CDN. It is how you host static assets or a static site properly rather than through the raw storage endpoint. The pattern to describe is a URL map routing /static to a backend bucket and everything else to a backend service, so static assets are served from the CDN edge and never touch your compute. That single split often removes most of the traffic from the application tier.

Question 21

A load balancer returns 502 but the backend works when curled directly. What do you check?

Accepted Answer

Health checks first — whether the firewall allows 130.211.0.0/22 and 35.191.0.0/16 to the health-check port, and whether the check path returns 200. Then the backend service port and protocol configuration, the timeout on the backend service versus how long the backend takes, and whether the backend closes connections faster than the load balancer's keepalive expects. The keepalive mismatch is the subtle one: if the backend's idle timeout is shorter than the load balancer's, the load balancer can send a request on a connection the backend is closing, producing intermittent 502s that are very hard to reproduce. Naming it is a strong signal.

Question 22

What timeouts exist on a GCP Application Load Balancer?

Accepted Answer

The backend service timeout, which is how long the load balancer waits for a response and defaults to 30 seconds; the keepalive timeout for idle connections to the backend; and for streaming or long-polling responses, the timeout applies to the whole response rather than to individual bytes on some configurations. The 30-second default is the number to know because it silently truncates longer requests, producing a 408 or 502 that the backend logs as successful. Long-running work should be made asynchronous rather than having the timeout raised indefinitely.

Question 23

How do you implement a canary release at the load balancer?

Accepted Answer

Use URL map traffic splitting with weighted backend services — for example 95% to the stable backend service and 5% to the canary — or route by a header so internal users hit the canary first. Increase the weight while watching error rate and latency, and revert by setting the weight back to zero. Header-based routing for internal testing before percentage rollout is the detail that shows practical experience, because it lets you validate with real production dependencies before exposing any customer. Automating the abort criterion is what makes it safe.

Question 24

What is a network endpoint group and why does it matter for load balancing?

Accepted Answer

A NEG identifies backends individually rather than as whole VMs. Zonal NEGs hold IP and port pairs used for container-native load balancing directly to GKE pods; serverless NEGs point at Cloud Run, Cloud Functions or App Engine; internet NEGs point at external endpoints; hybrid NEGs point at on-premises endpoints. Serverless NEGs are the mechanism that lets a global load balancer with Cloud CDN, Cloud Armor and IAP sit in front of Cloud Run, which is the production pattern for any serverless service with a custom domain. Container-native load balancing removing the extra network hop is the other headline.

Question 25

How would you serve a multi-region application with a single hostname?

Accepted Answer

A global external Application Load Balancer with one anycast IP and one DNS record, with backend services in each region and capacity configured so traffic spills over when a region is full or unhealthy. No DNS-based routing is needed, and failover happens in the network rather than waiting for a TTL. The data-tier question follows immediately and is where the real design work lies — a stateless compute tier is easy to spread, but the database must be multi-region or have a defined failover. An answer covering only the load balancer is incomplete and interviewers will push on it.

Question 26

What is Cloud Armor rate limiting and how would you configure it?

Accepted Answer

A Cloud Armor rule can throttle or ban clients exceeding a request rate, keyed by IP, by a header, by a cookie or by a user identifier, with a configurable enforcement window and ban duration. It is applied at the load balancer, so excess traffic is dropped before reaching your backends. Keying on something other than raw IP is often necessary because many users share an IP behind NAT, and IP-only limiting either blocks legitimate users or is too permissive. Naming the key choice as a design decision is what distinguishes a real answer.

Question 27

What headers does a GCP Application Load Balancer add or modify?

Accepted Answer

It appends the client IP and the proxy chain to X-Forwarded-For, sets X-Forwarded-Proto to the original scheme, and adds X-Cloud-Trace-Context for tracing. It also normalises some request properties, and custom request and response headers can be configured on the backend service. The X-Forwarded-For parsing rule matters: the client IP is the second-to-last entry rather than the first, because clients can spoof the header. Taking the first value naively is a real security bug in rate limiting and geo-blocking implementations.

Question 28

What is the difference between an external and an internal IP on a load balancer, and how do you reserve one?

Accepted Answer

An external load balancer has a public IP reachable from the internet — global for global load balancers, regional for regional ones. An internal one has a private IP from your subnet. Reserve a static address so the IP persists across recreation, which is required for stable DNS records and third-party allowlisting. The billing detail worth knowing is that a reserved static IP not attached to anything is charged at a higher rate, which is deliberate to discourage hoarding. That explains the "charges for IP addresses I am not using" line on a bill.

Question 29

How does load balancer logging work and what would you use it for?

Accepted Answer

Request logging can be enabled per backend service with a configurable sample rate, producing entries with client IP, request details, backend selected, latency breakdown, cache status and Cloud Armor decision. It is used for traffic analysis, debugging, security investigation and CDN hit-rate measurement. The latency breakdown is the valuable field: it separates time spent in the load balancer, in the network and in the backend, which immediately tells you whether a slow request is your application's fault. Sampling controls cost, since full logging at high volume is expensive.

Question 30

What is the difference between an SSL proxy and an HTTPS load balancer?

Accepted Answer

An HTTPS load balancer is an Application Load Balancer — it understands HTTP, so it can route by host and path, apply CDN and Cloud Armor, and inspect headers. An SSL proxy is a proxy Network Load Balancer that terminates TLS for arbitrary TCP protocols without understanding the payload, used for non-HTTP protocols that need TLS termination. The selection rule is simply whether the protocol is HTTP. Using an SSL proxy for HTTP traffic works but forfeits every layer 7 feature, which is a needless loss and a mistake an interviewer will notice.

Question 31

How would you handle a DDoS attack against a GCP-hosted application?

Accepted Answer

Ensure everything is behind a global load balancer, where Google absorbs volumetric layer 3 and 4 attacks automatically at the edge. Enable Cloud Armor with adaptive protection to detect anomalous layer 7 patterns, apply rate limiting and geo or IP blocking, and use preconfigured WAF rules. Ensure no VMs have public IPs that bypass the load balancer. The public-IP point is the architectural one: a VM with a direct public address receives attack traffic itself with no edge protection, so DDoS resilience depends on the entry-point design rather than on a product you enable during the attack.

Question 32

What is the difference between Cloud CDN and Media CDN?

Accepted Answer

Cloud CDN is integrated with the Application Load Balancer and suits general web content, APIs and static assets. Media CDN is a separate product built on YouTube's infrastructure and optimised for large-scale video streaming — high egress volume, long-tail content and streaming-specific features. The selection driver is scale and workload shape: large-scale video delivery has different economics and caching behaviour from web assets. Recommending Cloud CDN for a major streaming service, or Media CDN for a small website, both reveal unfamiliarity with why two products exist.

Question 33

What is a URL map and what routing can it express?

Accepted Answer

A URL map routes requests by host and path to backend services or backend buckets, and also supports header and query-parameter matching, URL rewrites, redirects, request and response header manipulation, CORS configuration, fault injection and weighted traffic splitting. Fault injection at the load balancer is the surprising capability worth naming — you can inject latency or errors for a percentage of traffic to test resilience without touching the application. That is chaos engineering built into the infrastructure.

Question 34

How do you migrate traffic from an old system to a new one with no downtime?

Accepted Answer

Put both behind the same load balancer as separate backend services and shift traffic by weight in the URL map, starting with a small percentage and increasing while comparing error rate and latency. Keep the old backend deployed until confidence is high, so rollback is a weight change. If the systems are in different environments, an internet NEG lets the load balancer route to an external endpoint during the transition. The internet NEG trick is the detail that makes this work for a migration off another cloud or a data centre: the load balancer can front an external origin while you move backends over, so the cutover is gradual rather than a DNS switch.

Question 35

What is the role of the capacity scaler on a backend service?

Accepted Answer

It multiplies the configured maximum capacity of a backend group, from 0 to 1. Setting it to 0 stops new traffic to that group while allowing existing connections to drain, which makes it the graceful mechanism for taking a zone or region out of service for maintenance or during an incident. Being able to name it as the drain control is valuable, because the alternative — deleting backends or failing health checks deliberately — is blunt and slower to reverse. It is one of the more useful operational levers people do not know exists.

Question 36

How do you test a load balancer configuration before it serves production traffic?

Accepted Answer

Create it with a separate hostname and certificate pointing at the new backends, validate with synthetic traffic and by overriding DNS resolution locally, verify health checks pass and headers arrive as expected, then move production DNS or shift weight. Cloud Armor rules should be run in preview mode first. Preview mode for WAF rules is the specific safety step, because OWASP rule sets produce false positives on legitimate application traffic and enforcing them on day one will block real users. Testing with a separate hostname avoids the all-or-nothing DNS cutover.

Question 37

What happens to requests during a backend deployment?

Accepted Answer

With a rolling update and correct configuration, new instances must pass health checks before receiving traffic, and removed instances drain in-flight requests before terminating. The requirements are a meaningful health check, a connection-draining timeout longer than your longest request, and an application that handles SIGTERM by finishing work and refusing new connections. All three must be right or you drop requests on every deploy — a low-rate 5xx blip that teams often accept as normal when it is entirely avoidable. Naming the SIGTERM handling as an application responsibility is the part most candidates miss.

Question 38

What is IAP on a load balancer and how does it change the architecture?

Accepted Answer

Identity-Aware Proxy enabled on a backend service requires every request to be authenticated and authorised by IAM before it reaches the backend, with optional device and context conditions. It replaces a VPN for internal applications, and the backend must verify the signed IAP JWT rather than trusting headers. The architectural change is removing network-based trust: the application is on the internet but only reachable by authorised identities. The JWT verification requirement is the security-critical implementation detail, because a backend reachable by any other path would otherwise be unprotected.

Question 39

How do you decide the health-check path and interval for a service?

Accepted Answer

The path should exercise the components required to serve traffic — process alive, dependencies reachable enough to respond — without being so deep that a transient downstream blip marks every instance unhealthy. Interval and thresholds should detect failure within your latency budget while tolerating one transient failure, typically a few seconds with two or three consecutive failures. The trap to name is a health check that queries the database: when the database blips, every backend fails simultaneously and the load balancer has nowhere to send traffic, turning a degradation into a total outage. Separating liveness from dependency readiness is the correct design.

Question 40

Design the traffic layer for a global SaaS application on GCP.

Accepted Answer

Cloud DNS with a single record to a global external Application Load Balancer on an anycast IP with Google-managed certificates and a TLS 1.2-minimum SSL policy. A URL map routing static paths to a backend bucket with Cloud CDN and application paths to regional backend services on serverless NEGs or container-native GKE NEGs, with RATE balancing mode and realistic capacity so regional spillover works. Cloud Armor with OWASP rules in enforcement after a preview period, rate limiting keyed on user identity, and adaptive protection. IAP on the admin backend service. Connection draining longer than the slowest request, health checks that exercise the application, request logging sampled for analysis, and traffic splitting in the URL map for canary releases with automated rollback. The closing scenario. The senior markers are configuring capacity so global failover actually functions, previewing WAF rules before enforcing, and splitting static content to a CDN-backed bucket — which is usually the largest single reduction in origin load and cost.

GCP Load Balancing, Cloud CDN & DNS Interview Questions and Answers

How to use this set