Restrict a Google Cloud load-balanced application so only specific client IP ranges (and Google health check ranges) can connect. Which action do you take?

The correct approach is to use firewall rules targeting instance tags. When a load balancer forwards traffic to backend instances, the source IP of the traffic seen by the instances is the load balancer's internal IP. Therefore, you cannot filter directly on the original client IP at the instance level using firewall rules. However, firewall rules can effectively filter traffic before it reaches the load balancer's backends. By tagging the backend instances (e.g., "application") and creating an ingress firewall rule that allows traffic from your specified client IP ranges and Google's health check IP ranges, you ensure only authorized traffic reaches the application. Access Context Manager/VPC Service Controls are for controlling access to Google Cloud services and resources at a higher level, not for filtering client IPs to a load-balanced application. Labels are for organizing resources and are not used by firewall rules for targeting; tags are the correct mechanism.