hardMultiple ChoiceObjective-mapped
Google ACE Practice Question: Planning a Private Service Connect (PSC)…
You are planning a Private Service Connect (PSC) configuration to allow your VPC to access a managed Cloud SQL instance over a private endpoint without exposing traffic to the public internet. What does Private Service Connect provide in this context?
⚠ Common exam trap
Many candidates confuse Private Service Connect with VPC peering or assume it provides bidirectional connectivity, when in fact PSC is a unidirectional, endpoint-based model that does not require peering or address space coordination.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
PSC provides a private, internal IP endpoint in your VPC that routes to the managed service without traversing the public internet.
Private Service Connect (PSC) allows you to access Google-managed services (like Cloud SQL) by creating a private, internal IP endpoint within your VPC. This endpoint uses an internal IP address from your VPC's subnet and forwards traffic to the service without ever leaving Google's network, thus avoiding the public internet. Unlike VPC peering, PSC does not require you to manage peering relationships or worry about overlapping IP ranges.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
PSC creates a VPC peering connection between your VPC and Google's service VPC.
Why it's wrong here
VPC peering establishes a full mesh of routes between two VPCs, enabling any instance in either network to reach any instance in the other, and it is a symmetric, network-layer relationship. PSC operates differently: you create a forwarding rule with an internal IP in your VPC, and that IP is mapped to a service attachment exposed by the managed service's producer network. This requires no peering, no route exchange, and does not give the managed service's VPC any visibility into your VPC, making it a one-way, service-specific connection rather than a peering relationship.
- ✓
PSC provides a private, internal IP endpoint in your VPC that routes to the managed service without traversing the public internet.
Why this is correct
PSC (Private Service Connect) provisions a forwarding rule in your VPC that allocates an internal IP address as an endpoint for the managed service, such as Cloud SQL. All traffic sent to that internal IP is routed over Google's internal network directly to the service's backends, without traversing the public internet, a VPN, or a NAT gateway. This provides private, low-latency connectivity while keeping the resource entirely within your VPC's IP space.
- ✗
PSC enables bidirectional private communication between your VPC and the service's VPC, similar to peering.
Why it's wrong here
PSC is strictly unidirectional: traffic can flow from your VPC into the managed service, but the service cannot initiate a connection back to your VPC through the PSC endpoint. This asymmetry is fundamental to PSC's design and distinguishes it from VPC peering, where traffic can flow bidirectionally between both networks. If your architecture requires the managed service to send data back into your VPC, you must use a separate mechanism, such as the service writing to BigQuery or Cloud Storage and your system consuming that output, rather than relying on PSC as a two-way channel.
- ✗
PSC replaces the need for a Serverless VPC Access connector when calling managed services from Cloud Run.
Why it's wrong here
Serverless VPC Access connectors are designed to let serverless compute products like Cloud Run, Cloud Functions, and App Engine make outbound calls to resources inside your VPC, such as Compute Engine instances or on-premises hosts via VPN. PSC, by contrast, connects your VPC to a Google-managed service's published endpoint, which is the opposite direction and a different purpose. Since they address different connectivity requirements, PSC does not replace the Serverless VPC Access connector, and you may still need the connector for serverless-to-VPC traffic.
Visual reference
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
IP address
An IP address is a unique numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication.
Key term
Cloud SQL
Cloud SQL is a fully managed relational database service that lets you set up, maintain, and scale SQL databases (like MySQL, PostgreSQL, and SQL Server) in the cloud without managing the underlying infrastructure.
About these practice questions
Courseiva writes every ACE question from scratch — 769 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.