Google ACE Planning and Configuring a Cloud Solution Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Cloud Functions (2nd gen) with VPC connector

  Why this is correct

  Cloud Functions (2nd gen) is built on Cloud Run and supports a Serverless VPC Access connector that makes the function a first-class citizen inside your VPC. With 2nd gen you can attach a VPC connector and set egress settings to route all outbound traffic through it, so the function can reach private resources using internal IPs. This also enables private inbound triggers, meaning the function can be invoked internally within the VPC, which is exactly what is needed to process events from a private resource.

• ✗

  Cloud Functions (1st gen) with VPC connector

  Why it's wrong here

  Cloud Functions (1st gen) supports Serverless VPC Access connectors only for outbound (egress) traffic, allowing the function to make requests to resources in a VPC but not to receive inbound traffic from that VPC. The function remains an externally reachable resource with a public URL, and it cannot be attached to a VPC as a network resource or triggered privately via internal IPs. Because the event source is in a VPC and likely needs to invoke or deliver events to the function internally, 1st gen's one-way outbound-only model is insufficient.

• ✗

  Cloud Functions (2nd gen) with Cloud VPN

  Why it's wrong here

  Cloud VPN creates an IPsec tunnel between an on-premises network and a Google Cloud VPC, which is a hybrid connectivity solution, not a mechanism for attaching a serverless function to a VPC. Even if Cloud Functions (2nd gen) is paired with Cloud VPN, the function itself still requires a VPC connector to route traffic into the VPC; the VPN tunnel only connects external networks to the VPC gateway. Without a VPC connector, the function's outbound requests would go over the public internet, and the VPN cannot provide the function with a private VPC identity or internal routing.

• ✗

  Cloud Functions (1st gen) with Cloud NAT

  Why it's wrong here

  Cloud NAT is designed to allow VMs and other resources that have no external IP addresses to make outbound connections to the internet by translating their private IPs to a public IP. It does not provide connectivity from a serverless function to a VPC, nor does it enable private resource discovery or internal IP communication within the VPC. For Cloud Functions (1st gen), adding Cloud NAT would not address the core limitation that 1st gen cannot be triggered privately from a VPC; it only solves the opposite problem of outbound internet access, so it is irrelevant for this requirement.

Go deeper

Related to this question