hardMultiple ChoiceObjective-mapped
Google ACE Practice Question: A Cloud Run service requires access to a private…
A Cloud Run service requires access to a private Cloud SQL instance in the same VPC. The Cloud SQL instance is not publicly accessible. How should the Cloud Run service connect to Cloud SQL without using the Cloud SQL Auth Proxy separately?
⚠ Common exam trap
Many candidates confuse Serverless VPC Access connectors with the Cloud SQL Auth Proxy, thinking that VPC connectivity alone is sufficient to reach a private Cloud SQL instance, but they miss that the proxy is required for authentication and encrypted tunneling even within the same VPC.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the Cloud Run service with `--add-cloudsql-instances` to connect via the built-in Auth Proxy
The Cloud Run service can use the `--add-cloudsql-instances` flag, which automatically deploys a built-in Cloud SQL Auth Proxy sidecar container within the same pod. This proxy establishes a secure, encrypted connection to the private Cloud SQL instance using the instance's private IP, without requiring the instance to have a public IP or the user to manage a separate proxy. The proxy authenticates via the service account attached to the Cloud Run service, enabling seamless and secure connectivity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use the Cloud SQL public IP with SSL required — Cloud Run can reach public IPs
Why it's wrong here
Using a Cloud SQL public IP with SSL required is technically reachable from Cloud Run, but it exposes the database to the public internet, creating unnecessary attack surface. Cloud SQL instances configured with only a private IP would have public access disabled altogether, forcing you to rely on firewall or IP allowlists. The built-in Auth Proxy via `--add-cloudsql-instances` provides secure, private connectivity without exposing the database, making it a better practice. Additionally, managing SSL certificates manually for instance connections adds complexity.
- ✓
Configure the Cloud Run service with `--add-cloudsql-instances` to connect via the built-in Auth Proxy
Why this is correct
Configuring the Cloud Run service with `--add-cloudsql-instances` is the native, recommended integration for Cloud SQL. This flag instructs Cloud Run to start the Cloud SQL Auth Proxy within the instance, creating a Unix socket at `/cloudsql/<INSTANCE_CONNECTION_NAME>` and using the service account to establish a secure TLS connection. It avoids managing proxy deployments, certificates, and public IP exposure while providing IAM-based authentication. This approach works for both public and private IP instances.
- ✗
Deploy a separate Cloud SQL Auth Proxy container in the same Cloud Run service as a sidecar
Why it's wrong here
Cloud Run (fully managed) runs a single container per instance and does not support sidecar containers natively; only Cloud Run for Anthos permits multiple containers per pod. Deploying a separate Cloud SQL Auth Proxy container in the same service is therefore impossible in standard Cloud Run. Instead, the `--add-cloudsql-instances` flag causes the Cloud Run runtime to embed the Auth Proxy as a process within your container's sandbox, providing the same benefit without an extra container.
- ✗
Enable Serverless VPC Access connector to route Cloud Run traffic to the private Cloud SQL IP
Why it's wrong here
Enabling Serverless VPC Access connector lets Cloud Run reach resources on a VPC network via internal IPs, but it is not necessary or optimal for Cloud SQL. Cloud SQL uses the Cloud SQL Auth Proxy for authenticated connections, and the built-in `--add-cloudsql-instances` flag automatically handles the proxy and IAM-based authentication. Routing raw private IP traffic through the connector does not provide the same level of database-specific security, and it adds VPC management overhead.
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
Cloud Run
Cloud Run is a fully managed compute platform from Google Cloud that lets you run containerized applications in a serverless environment, automatically scaling from zero to thousands of requests.
Key term
VPC
A Virtual Private Cloud (VPC) is a logically isolated section of a cloud provider's network where you can launch and manage resources like servers and databases with complete control over IP addressing, subnets, route tables, and security.
About these practice questions
This ACE question is part of Courseiva's 769-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.