Google PCA Practice Question: Managing and Provisioning a Solution Infrastructure
A Cloud Run service needs to access resources in a VPC network (e.g., a Cloud SQL instance). The service should be able to send requests to the VPC and receive responses. What is the correct configuration?
⚠ Common exam trap
PCA often tests the misconception that serverless services like Cloud Run can be 'placed in a subnet' or reached via VPC peering, when in reality they require a Serverless VPC Access connector (or Direct VPC egress) to bridge into the VPC.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a VPC connector and configure the Cloud Run service to use it for egress
Cloud Run services run outside the customer's VPC by default, so to reach private VPC resources like a Cloud SQL instance with a private IP, you must attach a Serverless VPC Access connector. The connector provides a bridge from the serverless environment into the specified VPC network and subnet, allowing outbound requests to private IPs and return traffic. Configuring the service to use the connector for egress (all traffic or private ranges only) is the documented, supported pattern for this requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a VPC connector and configure the Cloud Run service to use it for egress
Why this is correct
A Serverless VPC Access connector provides a path from Cloud Run into the VPC, letting the service send requests to private resources such as Cloud SQL and receive responses, which is exactly the bidirectional VPC access the scenario requires.
- ✗
Place the Cloud Run service in a VPC subnet
Why it's wrong here
Cloud Run is a fully managed, serverless platform; you cannot place its instances inside a subnet you control. It is tempting because subnet placement is how Compute Engine and GKE reach a VPC, but Cloud Run instead uses Serverless VPC Access connectors or Direct VPC egress.
- ✗
Use Cloud NAT to allow Cloud Run to access the VPC
Why it's wrong here
Cloud NAT provides outbound internet access for private resources; it does not connect Cloud Run to private VPC addresses such as a Cloud SQL internal IP. It is tempting because NAT solves egress, but the requirement here is private inbound reachability into the VPC.
- ✗
Use VPC peering between Cloud Run and the VPC
Why it's wrong here
VPC peering links two VPC networks; Cloud Run is not a VPC network, so there is nothing to peer with. It is tempting because peering connects private ranges, but Cloud Run requires a Serverless VPC Access connector or Direct VPC egress instead.
Visual reference
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
Learn chapter
IAM Policies, Service Accounts, and Auditing
Key term
Service
A service is a software component or system that performs a specific function and is available to be used by other programs or users over a network.
Key term
VPC
A Virtual Private Cloud (VPC) is a logically isolated section of a cloud provider's network where you can launch and manage resources like servers and databases with complete control over IP addressing, subnets, route tables, and security.
About these practice questions
One of 807 original PCA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Google Cloud exam blueprint
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.