Courseiva
hardMultiple ChoiceObjective-mapped

Google ACE Practice Question: A team deploys a Cloud Run service that must…

A team deploys a Cloud Run service that must access resources in a private VPC (a private Cloud SQL instance and a Redis instance on Memorystore). The Cloud Run service has no public IP connectivity requirements for these resources. What must be configured?

⚠ Common exam trap

Google Cloud often tests the misconception that serverless services like Cloud Run can natively reach VPC resources without explicit configuration, or that VPC Service Controls provide connectivity rather than security boundaries.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

Configure a Serverless VPC Access connector and specify it in the Cloud Run service deployment

Cloud Run is a serverless compute platform that runs in a Google-managed VPC, not the customer's VPC. To access private resources like Cloud SQL and Memorystore (Redis) within a customer VPC, you must configure a Serverless VPC Access connector. This connector bridges the serverless environment to the specified VPC, enabling private, internal IP communication without public internet exposure.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • Enable VPC Service Controls around Cloud Run to connect it to the VPC

    Why it's wrong here

    VPC Service Controls (VPC-SC) are a security perimeter mechanism that protects Google Cloud services from data exfiltration, not a connectivity solution. They define IAM-based access boundaries at the API level, but they do not create any routing or network path between Cloud Run and your VPC resources. Even with VPC-SC enabled, Cloud Run still requires a Serverless VPC Access connector or direct VPC egress to actually reach Cloud SQL and Memorystore.

  • Configure a Serverless VPC Access connector and specify it in the Cloud Run service deployment

    Why this is correct

    The correct solution is to create a Serverless VPC Access connector and attach it to your Cloud Run service during deployment (e.g., using `--vpc-connector`). The connector creates a bridge between the serverless environment and your VPC, allowing Cloud Run to reach Cloud SQL and Memorystore via their private, internal IP addresses. This setup preserves security by keeping all traffic inside your VPC and avoids public exposure of resources.

  • Assign an external IP to the Cloud SQL and Memorystore instances — Cloud Run can reach them via public internet

    Why it's wrong here

    Assigning public external IPs to Cloud SQL and Memorystore is a security anti-pattern that exposes sensitive database resources to the internet. Even though Cloud Run can technically reach resources via public IPs, doing so bypasses your VPC's private networking and firewall policies, increasing the attack surface. Best practice is to keep these resources on private IPs and use a Serverless VPC Access connector, which maintains traffic within Google's network and your VPC.

  • Cloud Run automatically connects to any VPC resource in the same project via project-level networking

    Why it's wrong here

    Cloud Run is a fully managed serverless platform that runs on Google's infrastructure, isolated from your VPC by default. It does not automatically join project-level networking or VPC peering; without an explicit connector, Cloud Run cannot resolve or route to private IPs of VPC resources. You must either deploy a Serverless VPC Access connector or use direct VPC egress to provide the needed private network access.

Quick reference

Cloud Service Model Comparison

ModelYou ManageProvider ManagesExamples
IaaSOS, runtime, apps, dataHardware, hypervisor, networkingEC2, Azure VMs, GCP Compute Engine
PaaSApps and dataOS, runtime, middleware, hardwareElastic Beanstalk, Azure App Service
SaaSData and settings onlyEverything elseMicrosoft 365, Salesforce, Workday
FaaS / ServerlessFunction code onlyInfra, scaling, runtimeLambda, Azure Functions, Cloud Run
CaaSContainers and appsKubernetes, OS, hardwareEKS, AKS, GKE

Go deeper

Related to this question

About these practice questions

Courseiva writes every ACE question from scratch — 769 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.