mediumMultiple ChoiceObjective-mapped
Google ACE Practice Question: Design a solution where a Cloud Function is…
You need to design a solution where a Cloud Function is triggered by HTTP requests from the internet, but it must also privately access a Cloud SQL instance that has no public IP. The Cloud Function should not expose the Cloud SQL instance to public traffic. Which configuration enables this?
⚠ Common exam trap
Google Cloud often tests the misconception that resources in the same project can communicate privately by default, but the trap here is that Cloud Functions run outside your VPC and require explicit configuration (like a VPC connector) to access private IP resources such as Cloud SQL.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a Serverless VPC Access connector and attach it to the Cloud Function to access Cloud SQL via private IP.
A Serverless VPC Access connector allows a Cloud Function to connect to a Cloud SQL instance via its private IP, enabling private network communication without exposing the database to the internet. The connector bridges the serverless environment to a VPC, and the Cloud SQL instance must have private IP enabled. This satisfies the requirement of private access while the function itself remains publicly triggerable via HTTP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable a public IP on the Cloud SQL instance and restrict access using Cloud SQL authorized networks.
Why it's wrong here
Assigning a public IP and using authorized networks relies on source-IP allowlisting, which still leaves the instance reachable from the internet and contradicts the requirement for no public exposure. Cloud SQL authorized networks are IP CIDR ranges that, while enforcing access control, do not protect against IP spoofing or misconfiguration within the allowed ranges. The correct approach avoids any public endpoint entirely.
- ✓
Configure a Serverless VPC Access connector and attach it to the Cloud Function to access Cloud SQL via private IP.
Why this is correct
A Serverless VPC Access connector bridges the Cloud Function's managed execution environment to your VPC network, allowing outbound requests over RFC 1918 private addresses. Attaching it to the function lets it reach the Cloud SQL instance's private IP without ever exposing a public endpoint, satisfying both connectivity and isolation. This is the only option that preserves the 'private IP only' security requirement.
- ✗
Use Cloud SQL Auth Proxy on a Compute Engine VM as a jump host between the function and the database.
Why it's wrong here
Using Cloud SQL Auth Proxy on a Compute Engine VM fails because a Cloud Function requires a VPC Connector to establish private network connectivity to resources like Cloud SQL within a private VPC network. The Auth Proxy, while providing secure authentication and encryption, does not create this fundamental network path for a serverless function. This option is tempting as the Auth Proxy is the recommended method for secure connections to Cloud SQL, and it would be correct if the application was running on a Compute Engine VM or GKE cluster that already has private network access.
- ✗
Deploy the Cloud Function in the same project as Cloud SQL; same-project resources can access each other privately by default.
Why it's wrong here
Being in the same Google Cloud project does not automatically create a network path between Cloud Functions and Cloud SQL. Cloud Functions execute in a Google-managed environment that is not attached to your VPC, so they cannot route to a private IP without a Serverless VPC Access connector. Same-project isolation is an IAM/billing boundary, not a network connectivity guarantee.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
Serverless
Serverless is a cloud computing model where the cloud provider manages the servers, and you only pay for the actual compute time your code uses, without having to worry about provisioning or maintaining infrastructure.
Key term
VPC
A Virtual Private Cloud (VPC) is a logically isolated section of a cloud provider's network where you can launch and manage resources like servers and databases with complete control over IP addressing, subnets, route tables, and security.
About these practice questions
One of 769 original ACE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.