TCP Proxy LB for Dual-Stack Port 700 to 800

PCNE By islever Editorial Last updated

Configuring load balancing.

Short answer

D Create a TCP proxy that uses backend services containing an instance group with two instances to serve IPv4 and IPv6 on port 700 and forward to port 800 with high availability.

Question

You are designing a new application that has backends internally exposed on port 800. The application will be exposed externally using both IPv4 and IPv6 via TCP on port 700. You want to ensure high availability for this application. What should you do?
  1. Create a network load balancer that used backend services containing one instance group with two instances.
  2. Create a network load balancer that uses a target pool backend with two instances.
  3. Create a TCP proxy that uses a zonal network endpoint group containing one instance.
  4. Create a TCP proxy that uses backend services containing an instance group with two instances. Correct Answer

Key Takeaways

It tests the split between passthrough network load balancers and proxy load balancers, with the trap being that port translation, IPv6 support, and high availability must all be satisfied by a single option.

This PCNE question tests external dual-stack TCP load balancing with port translation. The correct choice is D: a TCP proxy backed by a backend service on a two-instance instance group, since only proxy load balancers map port 700 to 800 while supporting IPv4 and IPv6 and redundancy.

Common mistake: Option A is the tempting wrong answer because its two-instance instance group appears to cover high availability and it mentions IPv6, but a passthrough network load balancer cannot translate frontend port 700 to backend port 800.

Expert Analysis

The governing constraint set

This scenario imposes three independent requirements at once: external exposure over both IPv4 and IPv6, TCP termination on port 700 with forwarding to backend port 800, and high availability for the backend fleet. Google Cloud's load-balancing summary distinguishes proxy-based load balancers (HTTP(S), SSL, and TCP proxy) from passthrough network load balancers. Only the proxy-based family terminates the frontend connection and re-originates it to backends, which is what allows the frontend port and the backend port to differ.

Why the network load balancer options fail

Options A and B describe passthrough network load balancers. A passthrough NLB preserves the client's source IP and, critically, preserves the destination port — traffic arriving on port 700 reaches the instances on port 800 only if the application itself listens there, so no port translation occurs. Additionally, the target-pool variant (option B) is explicitly IPv4-only for its frontend, which excludes it on the dual-stack requirement. Option A's instance-group backend would satisfy availability, but not port mapping, so it fails two of the three criteria.

Why option C fails

A TCP proxy backed by a zonal network endpoint group holding a single instance technically supports IPv6 and port mapping, but a lone instance in one zone provides no redundancy: a zone or instance failure takes the application down, violating the high-availability requirement.

Why option D is correct

Option D combines a TCP proxy load balancer — which supports IPv4 and IPv6 frontend addresses and performs TCP port translation from 700 to 800 — with a backend service attached to an instance group containing two instances, giving instance-level redundancy behind a health-checked backend service. This is the only choice meeting all three criteria simultaneously, so the correct answer is D.

Official Reference

https://cloud.google.com/load-balancing/docs/load-balancing-overview

This link opens the official vendor documentation in a new tab.

Exam Strategy

On load balancer questions, list the requirements first (protocols, IP versions, port mapping, redundancy) and eliminate options that satisfy only some of them. Remember that passthrough network load balancers preserve the destination port and, in the target-pool form, are IPv4-only — whenever the frontend and backend ports differ, short-circuit straight to a proxy load balancer and then check that the backend has at least two instances across failure domains.

Frequently Asked Questions

Why can't a passthrough network load balancer forward port 700 traffic to port 800?

Passthrough network load balancers do not terminate the TCP connection, so they preserve the destination port end to end. Only proxy load balancers such as the TCP proxy re-originates the connection and can translate frontend port 700 to backend port 800.

Does the external TCP proxy load balancer support IPv6 clients?

Yes. External TCP proxy load balancers accept both IPv4 and IPv6 frontend addresses, which makes them suitable for dual-stack exposure, unlike target-pool network load balancers that are IPv4-only.

How does the instance group provide high availability here?

The backend service health-checks instances in the instance group and spreads traffic across them; with two instances, traffic survives a single instance failure, and managed instance groups can additionally replace unhealthy or failed instances automatically.

More PCNE FAQ →

Community Votes

D
66%
A
27%
B
7%

66% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 31 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 31

  1. garytolson 👍 21
    D is the correct answer. The question has 3 criteria. High availability, IPv4 and IPv6 support, and translate the front end port to a different backend port. Answer A - Can not be correct because a Network load balancer is pass-through, the front end port and backend port will allways be the same. Answer B - same reason Answer C - Does not meet the HA requirement Answer D - Meets all 3 requirements, HA with 2 instance instance group, IPV4 and 6 support, and the port change requirement provided by the proxy component of the TCP LB. https://cloud.google.com/load-balancing/docs/tcp
  2. pfilourenco 👍 12 Answered A
    A is the correct, since with need to support IPV6: "Target pool-based network load balancers support only IPv4 traffic, and only support the TCP and UDP protocols." https://cloud.google.com/load-balancing/docs/network/networklb-target-pools
  3. GeorgS 👍 4 Answered D
    In my opinion D is correct. The network loadbalancer just supports pass-through. But in this case, we need to forward it to another port. That is not pass-through. https://cloud.google.com/load-balancing/docs/load-balancing-overview?hl=en#summary-of-google-cloud-load-balancers
  4. thewalker 👍 3 Answered D
    To ensure high availability for an application that is exposed externally using both IPv4 and IPv6 via TCP on port 700, you should use a TCP proxy with a backend service that contains an instance group with two instances. A network load balancer can only be used to expose applications that are exposed using HTTP or HTTPs. A target pool backend can only be used with a network load balancer. A zonal network endpoint group can only be used with a TCP proxy. Therefore, the best option is to create a TCP proxy that uses backend services containing an instance group with two instances. Here is an example of how to create a TCP proxy that uses backend services containing an instance group with two instances:
  5. mshry 👍 3 Answered D
    Why not D. TCP Proxy is Global and supports IPv6 with a single port between 1-65535. https://cloud.google.com/load-balancing/docs/forwarding-rule-concepts#port_specifications
Show 25 more comments
  1. mshry 👍 3 Answered A
    Totally assumed LB after the TCP Proxy. Tricky stuff. Answer should be A.
  2. thewalker 👍 2
    gcloud compute target-tcp-proxies create my-tcp-proxy \ --project=my-project \ --backend-service=my-backend-service \ --port-name=port-700 gcloud compute backend-services create my-backend-service \ --project=my-project \ --protocol=TCP \ --port-name=port-800 \ --health-checks=my-health-check \ --instance-group=my-instance-group gcloud compute instance-groups managed create my-instance-group \ --project=my-project \ --zone=us-central1-a \ --template=my-instance-template \ --size=2 Once you have created the TCP proxy, backend service, and instance group, you can expose your application externally using both IPv4 and IPv6 via TCP on port 700.
  3. Thornadoo 👍 2
    This question is all over the place. Firstly options C & D all point to internal TCP Proxy LB which doesn't support IPv6. Same with Option B (Target Pool) which doesn't support IPv6. Now answer A supports IPv6, but passthroughs maintain the same port throughout whereas in this case the requirement is that 700 should change to 800. The right answer would be External TCP Proxy Load-Balancer.
  4. pfilourenco 👍 2
    Run dual stack. To serve both IPv6 and IPv4 clients, create two load balancer IP resources—one for IPv6 and the other for IPv4—and associate both with the same IPv4 application instances. IPv4 clients connect to the IPv4 address while IPv6 clients connect to the IPv6 address. So, A is the correct, since we are talking about only one load balancer.
  5. rglearn 👍 2 Answered D
    you need to have proxy supported Load balancer in between to do port forwarding service. I checked on GCP console and could find option of mentioning ports for frontend and backend only in TCP proxy LB. on top of that it also supports IPv6. Hence Option D
  6. nosense 👍 2
    I'm not sure, that TCP Proxy mean like load balancer. Probably "a server that acts as an intermediary between a client and another server" this reason why I choose A
  7. omermahgoub 👍 2
    Internal TCP proxy load balancers do not support IPv6 https://cloud.google.com/load-balancing/docs/ipv6#limitations
  8. didek1986 👍 2 Answered A
    A is correct tcp proxy in eventually part but part of NLB https://cloud.google.com/load-balancing/docs/tcp
  9. Dan137 👍 2 Answered D
    TCP proxy supports IPV6: https://cloud.google.com/load-balancing/docs/tcp#benefits
  10. gonlafer 👍 2 Answered A
    Tricky question. D & C do not mention LB, just TCP Proxy. To me it's A
  11. pfilourenco 👍 2
    So maybe D is also correct...and is global.
  12. desertlotus1211 👍 2
    It's external TCP proxy... not internal
  13. rmx86 👍 2 Answered D
    D because of the port mapping
  14. 0d2fdfa 👍 1 Answered D
    IPv6 Support: External Network Load Balancers (Options A and B) only support IPv4 for the frontend (unless using the newer regional proxy-based version, but "Network Load Balancer" typically refers to the Passthrough NLB). TCP Proxy Load Balancing supports both IPv4 and IPv6 addresses for client traffic. Port Mapping/Translation: The application is exposed externally on port 700 but the backends listen on port 800. Passthrough Network Load Balancers (A and B) cannot perform port translation; the traffic arrives at the backend on the same port it was sent to (port 700). TCP Proxy Load Balancers (D) can receive traffic on one port and proxy it to a completely different port on the backend.
  15. mity99 👍 1
    One of the key features of the TCP Proxy Load Balancer is the ability to perform port forwarding, which allows you to change the incoming port number to a different port number when forwarding to a backend instance.
  16. desertlotus1211 👍 1
    Answer is D: The questions mention High Availability. Although an External Network (passthrough LB) can do IPv4 and IPv6 and port forwarding - it's regional... External TCP Proxy is global...
  17. ccieman2016 👍 1 Answered B
    Exposed port 800 elimated C and D, that isn't support this port. A is wrong too, https://cloud.google.com/load-balancing/docs/backend-service#backends. B is correct.
  18. pfilourenco 👍 1
    Support for all ports. External TCP Proxy Load Balancing allows any valid port from 1-65535. https://cloud.google.com/load-balancing/docs/tcp#benefits
  19. mshry 👍 1
    Oh wow, good catch. Totally assumed LB after the TCP Proxy. Tricky stuff. Answer should be A.
  20. ulkerra 👍 1 Answered D
    Port change requirement is only met with TCP proxy LB. HA requires more than one instance.
  21. pfilourenco 👍 1
    Only if we want IPv6 termination. If we need dual stack on backend the correct is A.
  22. pfilourenco 👍 1
    Looks like TCP proxy that uses backend services also support IPv6.
  23. ulkerra 👍 1 Answered D
    port change requirement is not possible in network load balancers
  24. 09bd94b 👍 1 Answered D
    Must be D because of the port forwarding
  25. nosense 👍 1
    yeap. A is right because needed IPv6.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Configuring Policy-Based VPN for Non-BGP On-Premises Networks

S-grade

Deploying Packet Mirroring Policies in GCP Regions

S-grade

Troubleshooting Asymmetric Traffic on Google Cloud Interconnect

S-grade

Hub-and-Spoke Centralized Egress with VPC Peering

S-grade

Practice All PCNE Questions

Access 80 questions with complete answers and detailed explanations.

View Full PCNE Practice Test →

← Back to PCNE Study Guide