Google PCA Practice Question: Managing and Provisioning a Solution Infrastructure
A team is deploying a microservice on Cloud Run that needs to access a Cloud SQL database securely. They want to avoid using public IPs and ensure traffic stays within Google's network. Which configuration should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Serverless VPC Access and assign a private IP to the Cloud SQL instance
Serverless VPC Access allows Cloud Run to connect to a VPC network via a VPC connector. Combined with Private Services Access, Cloud SQL can be configured with a private IP (within the VPC) and accessed without traversing the public internet. Cloud SQL Proxy is a sidecar pattern that can use public IP with SSL, but it does not keep traffic entirely within Google's network if the Cloud SQL instance uses a public IP. Private Google Access is for on-premises or VM access to Google APIs, not for Cloud Run to Cloud SQL.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure Cloud SQL with a public IP and use Cloud SQL Proxy in the Cloud Run service
Why it's wrong here
Cloud SQL Proxy uses public IP with SSL, so traffic may traverse the public internet. It does not guarantee traffic stays within Google's network.
- ✗
Enable Private Google Access on the VPC subnet
Why it's wrong here
Private Google Access allows VMs to access Google APIs via internal IP, but does not extend to Cloud Run or provide connectivity to Cloud SQL private IP.
- ✓
Use Serverless VPC Access and assign a private IP to the Cloud SQL instance
Why this is correct
Serverless VPC Access connects Cloud Run to your VPC, and Cloud SQL private IP ensures traffic stays within Google's network.
- ✗
Create a VPC network peering between the Cloud Run tenant project and the Cloud SQL project
Why it's wrong here
Cloud Run does not support direct VPC peering; Serverless VPC Access is required to connect Cloud Run to a VPC.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
Learn chapter
Introduction to Google Cloud Platform
Key term
IPS
An Intrusion Prevention System (IPS) is a network security device that monitors traffic in real time and automatically blocks threats before they reach your systems.
Key term
VPC network
A Virtual Private Cloud (VPC) network is a logically isolated section of a public cloud provider's infrastructure where you can launch cloud resources in a virtual network that you define and control.
About these practice questions
Courseiva writes every PCA question from scratch — 955 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.