Google ACE Practice Question: A startup runs its application entirely on Cloud…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Cloud DNS — create a CNAME record pointing to the Cloud Run URL

  Why it's wrong here

  Creating a CNAME record in Cloud DNS that points to the default Cloud Run URL is insufficient because Cloud Run issues TLS certificates only for endpoints it recognizes via Domain Mappings. When a request arrives with your custom Host header, the run.app frontend will not route it to the service, resulting in TLS or 404 errors. You must first create a Domain Mapping so Cloud Run can verify ownership and provision a certificate for your domain; the CNAME alone is not the missing piece.

• ✓

  Cloud Run Domain Mappings or a Global Load Balancer with a Serverless NEG

  Why this is correct

  Cloud Run Domain Mappings and a Global Load Balancer with a Serverless NEG are both valid, production-ready approaches. Domain Mappings offer the simplest path for a single service: you verify the domain, and Cloud Run automatically provisions a Google-managed TLS certificate. The load balancer approach is better when you need advanced routing, multi-region failover, or CDN/WAF features; a Serverless NEG allows the global external Application Load Balancer to direct traffic to your Cloud Run service. Choose based on whether you need basic custom-domain support or full-fledged edge routing.

• ✗

  Cloud Endpoints with an API gateway configuration

  Why it's wrong here

  Cloud Endpoints is an API management system based on Service Control/Service Management; it provides authentication, quotas, and monitoring, but its ESPv2 proxy does not map custom domains to Cloud Run. Even if you deploy Endpoints in front of a Cloud Run service, you still need a separate mechanism—like Domain Mapping or a load balancer—to make the custom domain reach the gateway. Thus, it adds significant configuration overhead and is not the standard solution for simply exposing a service on a custom domain.

• ✗

  Firebase Hosting rewrites to Cloud Run

  Why it's wrong here

  Firebase Hosting's rewrite feature can proxy requests to a Cloud Run service, which works for sites already hosted on Firebase, but it forces you to add and maintain a Firebase project, an extra layer of indirection, and an additional hit on the request path. It is not a native Cloud Run solution. Cloud Run's own Domain Mapping handles custom domains directly with automatic TLS, while the load balancer option adds global capabilities without requiring a Firebase dependency. Use Firebase Hosting rewrites only if you are already committed to Firebase and need to serve static content alongside your serverless workload.

Go deeper

Related to this question