hardMultiple ChoiceObjective-mapped
Google ACE Practice Question: A team deploys a Cloud Run service that must…
A team deploys a Cloud Run service that must access resources in a private VPC (a private Cloud SQL instance and a Redis instance on Memorystore). The Cloud Run service has no public IP connectivity requirements for these resources. What must be configured?
⚠ Common exam trap
Google Cloud often tests the misconception that serverless services like Cloud Run can natively reach VPC resources without explicit configuration, or that VPC Service Controls provide connectivity rather than security boundaries.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a Serverless VPC Access connector and specify it in the Cloud Run service deployment
Cloud Run is a serverless compute platform that runs in a Google-managed VPC, not the customer's VPC. To access private resources like Cloud SQL and Memorystore (Redis) within a customer VPC, you must configure a Serverless VPC Access connector. This connector bridges the serverless environment to the specified VPC, enabling private, internal IP communication without public internet exposure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable VPC Service Controls around Cloud Run to connect it to the VPC
Why it's wrong here
VPC Service Controls (VPC-SC) are a security perimeter mechanism that protects Google Cloud services from data exfiltration, not a connectivity solution. They define IAM-based access boundaries at the API level, but they do not create any routing or network path between Cloud Run and your VPC resources. Even with VPC-SC enabled, Cloud Run still requires a Serverless VPC Access connector or direct VPC egress to actually reach Cloud SQL and Memorystore.
- ✓
Configure a Serverless VPC Access connector and specify it in the Cloud Run service deployment
Why this is correct
The correct solution is to create a Serverless VPC Access connector and attach it to your Cloud Run service during deployment (e.g., using `--vpc-connector`). The connector creates a bridge between the serverless environment and your VPC, allowing Cloud Run to reach Cloud SQL and Memorystore via their private, internal IP addresses. This setup preserves security by keeping all traffic inside your VPC and avoids public exposure of resources.
- ✗
Assign an external IP to the Cloud SQL and Memorystore instances — Cloud Run can reach them via public internet
Why it's wrong here
Assigning public external IPs to Cloud SQL and Memorystore is a security anti-pattern that exposes sensitive database resources to the internet. Even though Cloud Run can technically reach resources via public IPs, doing so bypasses your VPC's private networking and firewall policies, increasing the attack surface. Best practice is to keep these resources on private IPs and use a Serverless VPC Access connector, which maintains traffic within Google's network and your VPC.
- ✗
Cloud Run automatically connects to any VPC resource in the same project via project-level networking
Why it's wrong here
Cloud Run is a fully managed serverless platform that runs on Google's infrastructure, isolated from your VPC by default. It does not automatically join project-level networking or VPC peering; without an explicit connector, Cloud Run cannot resolve or route to private IPs of VPC resources. You must either deploy a Serverless VPC Access connector or use direct VPC egress to provide the needed private network access.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
Cloud SQL
Cloud SQL is a fully managed relational database service that lets you set up, maintain, and scale SQL databases (like MySQL, PostgreSQL, and SQL Server) in the cloud without managing the underlying infrastructure.
Key term
Private cloud
A private cloud is a cloud computing environment that is used exclusively by a single organization, offering the benefits of cloud services — like scalability and self-service — but with dedicated infrastructure that is not shared with any other company.
About these practice questions
Courseiva writes every ACE question from scratch — 769 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.