Linux Foundation PCA Exam - Topic 3 Question 3 Discussion

Actual exam question for Linux Foundation's PCA exam

Question #: 3
Topic #: 3

[All PCA Questions]

What Prometheus component would you use if targets are running behind a Firewall/NAT?

APull Proxy

BPull Gateway

CHA Proxy

DPushProx

Show Suggested Answer

Suggested Answer: D

When Prometheus targets are behind firewalls or NAT and cannot be reached directly by the Prometheus server's pull mechanism, the recommended component to use is PushProx.

PushProx works by reversing the usual pull model. It consists of a PushProx Proxy (accessible by Prometheus) and PushProx Clients (running alongside the targets). The clients establish outbound connections to the proxy, which allows Prometheus to ''pull'' metrics indirectly. This approach bypasses network restrictions without compromising the Prometheus data model.

Unlike the Pushgateway (which is used for short-lived batch jobs, not network-isolated targets), PushProx maintains the Prometheus ''pull'' semantics while accommodating environments where direct scraping is impossible.

Verified from Prometheus documentation and official PushProx design notes -- Monitoring Behind NAT/Firewall, PushProx Overview, and Architecture and Usage Scenarios sections.

by Destiny at Nov 23, 2025, 06:37 PM

Limited Time Offer

25%

Off

Get Premium PCA Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Ashlyn

25 days ago

Pull Proxy makes sense for NAT issues.

upvoted 0 times

...

Stephania

1 month ago

HA Proxy? Not sure it fits here.

upvoted 0 times

...

Weldon

1 month ago

What about PushProx? Seems useful.

upvoted 0 times

...

Reyes

1 month ago

I feel Pull Gateway is better.

upvoted 0 times

...

Tambra

2 months ago

I think it's Pull Proxy.

upvoted 0 times

...

Micah

2 months ago

I thought NAT issues were handled differently, though.

upvoted 0 times

...

Vince

2 months ago

A) Pull Proxy is the way to go!

upvoted 0 times

...

Charlesetta

2 months ago

Wait, isn't it D) PushProx? I'm not so sure.

upvoted 0 times

...

Reta

3 months ago

D) PushProx, because who doesn't love a good push-based proxy? Am I right, folks?

upvoted 0 times

...

Daniel

3 months ago

Hmm, D) PushProx. Sounds like the perfect solution for my firewall-protected targets.

upvoted 0 times

...

Henriette

3 months ago

D) PushProx, no doubt about it. Gotta love that push-based approach.

upvoted 0 times

...

Dong

3 months ago

I'd go with D. PushProx, it's designed for that exact use case.

upvoted 0 times

...

Skye

3 months ago

D) PushProx seems like the way to go if targets are behind a firewall.

upvoted 0 times

...

Rebbecca

4 months ago

I’m a bit confused between Pull Gateway and PushProx. I know one is for pulling metrics, but I can’t recall which one is specifically for NAT situations.

upvoted 0 times

...

Shawna

4 months ago

I feel like I’ve seen a question like this before, and I think the answer is Pull Proxy. It makes sense for targets that can’t be reached directly.

upvoted 0 times

...

Dean

4 months ago

I think it might be the Pull Gateway, but I'm not entirely sure. I remember something about how it handles targets behind NAT.

upvoted 0 times

...

Annelle

4 months ago

I'm pretty confident B is the right answer here. The Pull Gateway is designed specifically for scraping targets that are behind a NAT or firewall. The other options don't seem as well-suited for that use case.

upvoted 0 times

...

Louvenia

4 months ago

Option A, the Pull Proxy, sounds like it could work too. I'm not 100% sure of the differences between the proxy and gateway, but either one might be able to handle the firewall issue.

upvoted 0 times

...

Rocco

4 months ago

D) PushProx - that's the one I was thinking of. I remember reading about that in the Prometheus docs as the solution for scraping targets behind a firewall.

upvoted 0 times

...

Breana

5 months ago

I disagree, it's B) Pull Gateway for sure.

upvoted 0 times

...

Derick

5 months ago

I think it's definitely A) Pull Proxy.

upvoted 0 times

...

Amos

5 months ago

I agree, Pull Gateway could work too.

upvoted 0 times

...

Carol

5 months ago

I remember that HA Proxy is more about load balancing, so I don’t think it’s the right choice here. It’s definitely between the other options.

upvoted 0 times

...

Una

5 months ago

Hmm, I'm a bit unsure about this one. I know Prometheus has some options for dealing with firewalls, but I can't quite remember the specifics. I'll have to think this through carefully.

upvoted 0 times

...