Google ACE Planning and Configuring a Cloud Solution Practice Question
A company uses Cloud SQL for MySQL to host a database. The database must be accessible from a Compute Engine VM in the same region but in a different VPC network (VPC-A). The company does not want to use public IP addresses or VPN. What should the engineer do to enable connectivity?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set up VPC Network Peering between VPC-A and the VPC where Cloud SQL is deployed, and configure Cloud SQL with a private IP
Cloud SQL private services access requires the Cloud SQL instance to be in a VPC network. For connectivity across VPCs, VPC Network Peering can be used, as both VPCs are in the same project or across projects. Private services access connects Cloud SQL to a VPC, and peering allows another VPC to access it.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Export the Cloud SQL instance as a dump and recreate it in VPC-A
Why it's wrong here
Exporting the database and recreating the instance inside VPC-A is a data migration, not a connectivity fix. It forces downtime, application connection string changes, and manual re-import, while losing the original instance’s automatic backups and scaling configuration. This approach also does not solve how the existing Cloud SQL service should be reached from VPC-A; it merely moves the problem to a different location.
- ✓
Set up VPC Network Peering between VPC-A and the VPC where Cloud SQL is deployed, and configure Cloud SQL with a private IP
Why this is correct
Setting up VPC Network Peering between VPC-A and the VPC where Cloud SQL is deployed allows private, RFC1918 traffic to flow over Google’s internal backbone without a VPN, NAT gateway, or public IP. Once Cloud SQL is configured with a private IP, its address is allocated from a reserved range in that VPC, so VM instances in the peered VPC-A can connect directly. This satisfies the requirement of avoiding both public exposure and VPN.
- ✗
Configure the Cloud SQL instance with a public IP and allow the VM's IP in authorized networks
Why it's wrong here
Assigning a public IP and adding the VM’s IP to Cloud SQL authorized networks permits access by source-IP allowlist, but it contradicts the stated requirement to avoid public IP use. Authorized networks only accept external IP addresses, so a VM with only an internal address cannot be allowlisted from within the peer; traffic would also traverse the public internet. This approach increases the attack surface and fails the company’s private-connectivity constraint.
- ✗
Use Cloud VPN to connect VPC-A to the VPC where Cloud SQL is deployed
Why it's wrong here
Using Cloud VPN to connect VPC-A to the Cloud SQL VPC could work technically, but the company explicitly said they do not want a VPN. VPN adds operational overhead for tunnel health, routing, and gateway endpoints, and it introduces extra latency compared with VPC peering. Since Cloud SQL’s private IP is already reachable through Google’s peering infrastructure, a VPN is an unnecessary and rejected alternative.
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
VPC
A Virtual Private Cloud (VPC) is a logically isolated section of a cloud provider's network where you can launch and manage resources like servers and databases with complete control over IP addressing, subnets, route tables, and security.
Key term
Region
A region is a distinct geographic location where a cloud provider operates multiple data centers that are connected by low-latency networks and provide cloud services.
About these practice questions
One of 769 original ACE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.