mediumMultiple ChoiceObjective-mapped
Google ACE Practice Question: Migrating a legacy monolithic application to…
A company is migrating a legacy monolithic application to Google Cloud. The application runs on a single VM and contains both the web server and backend processes. The team wants to separate concerns and deploy the web tier on Cloud Run and the backend on Compute Engine. They need to allow the Cloud Run service to initiate HTTPS connections to the backend VM. What is the most secure way to accomplish this?
⚠ Common exam trap
Google Cloud often tests the misconception that Cloud NAT or public IPs are needed for serverless-to-VM communication, but the correct approach is to use Serverless VPC Access for private, secure connectivity without exposing the backend.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Serverless VPC Access to connect Cloud Run to the VPC, and keep the VM internal
Serverless VPC Access creates a direct, private connection between Cloud Run and your VPC, allowing the Cloud Run service to reach the backend VM using its internal IP address. This avoids exposing the VM to the public internet, which is the most secure approach for initiating HTTPS connections between the two tiers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign a public IP to the backend VM and configure firewall rules to allow HTTPS from any source
Why it's wrong here
Assigning a public IP to the backend VM and configuring firewall rules to allow HTTPS from any source would expose the VM directly to the internet, which is a significant security risk. It also bypasses VPC internal networking, and allowing traffic from 0.0.0.0/0 makes the VM globally reachable, increasing attack surface. This approach does not leverage any private connectivity mechanism and would require public DNS and additional hardening.
- ✗
Set up a VPN tunnel between Cloud Run and the VPC
Why it's wrong here
A VPN tunnel is an encrypted link between two networks, such as an on-premises network and a VPC, or between two VPCs. Cloud Run is a fully managed serverless service that does not exist as a network endpoint and cannot terminate a VPN tunnel, so this option is technically impossible. Even if it were possible, it would be overkill and not the intended way to connect a serverless service to VPC resources.
- ✗
Use Cloud NAT to provide outbound internet access to Cloud Run
Why it's wrong here
Cloud NAT is designed to give Compute Engine instances with no public IP address outbound internet access, and it does not allow inbound connections or private-to-private service communication. Since Cloud Run is not a VPC resource, Cloud NAT cannot be used to make Cloud Run reach internal VMs anyway. The correct solution for Cloud Run is a Serverless VPC Access connector, which provides a bidirectional path into the VPC for egress requests.
- ✓
Use Serverless VPC Access to connect Cloud Run to the VPC, and keep the VM internal
Why this is correct
Using Serverless VPC Access to connect Cloud Run to the VPC and keeping the VM internal is the correct approach because it enables private, encrypted communication over the Google network. The connector lets Cloud Run reach the VM's internal IP address without the VM ever needing a public IP or a firewall rule for public traffic. This minimizes the attack surface and is the recommended pattern for serverless-to-VPC connectivity.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
VPC
A Virtual Private Cloud (VPC) is a logically isolated section of a cloud provider's network where you can launch and manage resources like servers and databases with complete control over IP addressing, subnets, route tables, and security.
Key term
Serverless
Serverless is a cloud computing model where the cloud provider manages the servers, and you only pay for the actual compute time your code uses, without having to worry about provisioning or maintaining infrastructure.
About these practice questions
Courseiva writes every ACE question from scratch — 769 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.