Google PCA Manage and provision cloud infrastructure Practice Question
A Cloud Run service frequently fails with 502 errors when making requests to a backend service running on Compute Engine. The two services are in the same VPC network. The Cloud Run service is configured with a VPC connector. What is the most likely cause?
⚠ Common exam trap
Watch out — candidates often confuse VPC Network Peering (used for inter-VPC connectivity) with the VPC connector (used for serverless-to-VPC access), and they overlook the firewall rules that must explicitly allow traffic from the connector's IP range.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The VPC connector is not attached to the correct subnet, or the firewall rules are blocking traffic from the connector's IP range.
Cloud Run uses a VPC connector to send requests to resources in a VPC. If the connector is attached to the wrong subnet, its egress traffic may not reach the Compute Engine instance, or firewall rules may block traffic from the connector's IP range (e.g., 10.8.0.0/28). This results in 502 errors from the backend, as the Cloud Run service cannot establish a TCP connection to the Compute Engine instance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Cloud Run service needs to be peered with the VPC using VPC Network Peering.
Why it's wrong here
A VPC connector already provides the private path from Cloud Run into the VPC, so peering is redundant and cannot be configured for Cloud Run directly. Peering links two VPC networks, which is the right tool when joining separate networks, not for serverless egress into one network.
- ✗
The VPC connector is set to a low number of instances, causing traffic throttling.
Why it's wrong here
Connector instance count governs throughput ceiling, not per-request failure; throttling surfaces as latency and queueing rather than immediate 502s. Raising max instances is tempting when traffic is heavy, but the connector is already established, so the fault lies in the backend rejecting or timing out connections.
- ✓
The VPC connector is not attached to the correct subnet, or the firewall rules are blocking traffic from the connector's IP range.
Why this is correct
Serverless VPC access routes Cloud Run egress through the connector's own subnet and IP range, not the service's. If the connector sits in the wrong subnet or firewall rules omit its range, Compute Engine silently drops packets, surfacing as 502 responses.
- ✗
The Cloud Run service's service account lacks the roles/compute.instanceAdmin role.
Why it's wrong here
compute.instanceAdmin manages Compute Engine resources; it grants no network path or request permission. Cloud Run reaches the VM through the VPC connector, so the 502 stems from connectivity or the backend refusing traffic, not IAM on instances. That role is tempting when access errors appear, but it is irrelevant here.
Visual reference
Go deeper
Related to this question
Learn chapter
Google Kubernetes Engine (GKE)
Key term
VPC network
A Virtual Private Cloud (VPC) network is a logically isolated section of a public cloud provider's infrastructure where you can launch cloud resources in a virtual network that you define and control.
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
About these practice questions
One of 807 original PCA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.