Question 165 of 1,446
PCDE Migrate data solutions Practice Question
An engineer is using Database Migration Service to migrate a MySQL database to Cloud SQL. They need to set up a source connection profile. Which TWO methods can the engineer use to allow DMS to connect to the source database? (Choose 2 correct answers.)
⚠ Common exam trap
Google Cloud DMS supports two direct connection methods for source connection profiles: VPC peering (private IP) and IP allowlisting (public IP). Candidates may mistakenly select Cloud VPN or Cloud SQL Auth Proxy, which are supporting infrastructure or unrelated services, not valid profile methods.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
VPC peering for private IP
VPC peering allows DMS to connect to a source database using private IP addresses without traversing the public internet, which is a secure and recommended method for connectivity within Google Cloud. This method establishes a direct, low-latency connection between the DMS service's VPC and the source database's VPC, provided the IP ranges do not overlap. It is particularly suitable when the source database is hosted in a different VPC or on-premises via a VPN-connected VPC.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
VPC peering for private IP
Why this is correct
If the source uses private IP, use VPC peering to connect.
- ✗
No public endpoint
Why it's wrong here
Not a standard method for DMS.
- ✓
IP allowlisting for public IP
Why this is correct
If the source has a public IP, allowlist the DMS IP ranges.
- ✗
Cloud SQL Auth Proxy
Why it's wrong here
Auth Proxy is used to connect to Cloud SQL, not to the source database.
- ✗
Cloud VPN
Why it's wrong here
Cloud VPN can connect on-premises to GCP, but DMS connection profile uses IP allowlist or peering directly.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
5 more ways this is tested on PCDE
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An engineer needs to connect Database Migration Service to a source MySQL database that has only a private IP address. The Cloud SQL destination is also private. What is the recommended method for DMS to connect to the source?
easy- A.Use a Cloud VPN tunnel with static IP
- B.Use Cloud NAT to provide outbound connectivity
- ✓ C.Use VPC peering or Cloud SQL Auth Proxy
- D.Use the source database's public IP with IP allowlisting
Why C: For private IP sources, VPC peering or Cloud SQL Auth Proxy can be used. Auth Proxy is recommended for secure connectivity without public IP exposure.
Variation 2. An engineer needs to migrate a 500 GB MySQL database to Cloud SQL. The source is in a private network with no public IP. The Cloud SQL instance will also use a private IP. Which connectivity method should the engineer use for Database Migration Service?
medium- A.Assign a public IP to the source database and allowlist it in Cloud SQL.
- ✓ B.Use VPC peering between the source network and the Cloud SQL VPC.
- C.Use Cloud VPN to connect the source network to Cloud SQL.
- D.Configure IP allowlisting on Cloud SQL to accept traffic from the source's private IP range.
Why B: For private IP scenarios, DMS requires VPC peering between the source network and the Cloud SQL VPC. Alternatively, Cloud SQL Auth Proxy can be used if the source can connect to the proxy, but VPC peering is the recommended direct method for DMS.
Variation 3. A company is migrating a MySQL database to Cloud SQL using Database Migration Service (DMS). The source database is on-premises with a public IP address. Which networking configuration is required on the source to allow DMS to connect?
easy- A.Create a VPC peering connection between the source and DMS.
- B.Install the Cloud SQL Auth Proxy on the source database.
- ✓ C.Allowlist the DMS public IP addresses in the source database firewall.
- D.Configure a Cloud VPN tunnel between the on-premises network and Google Cloud.
Why C: For DMS to connect to a source with a public IP, the source must allowlist the IP addresses of the DMS instance to bypass firewall restrictions.
Variation 4. An engineer is configuring a Cloud Build build pool to connect to resources in a VPC network. They need to ensure the build can access a private Artifact Registry repository. Which three steps should they take?
hard- ✓ A.Set up Private Service Connect for Artifact Registry
- B.Enable public access on the Artifact Registry repository
- ✓ C.Create a private build pool with the 'network' field set to the VPC network
- D.Configure a Cloud NAT gateway for the VPC
- ✓ E.Grant the Cloud Build service account the 'Artifact Registry Reader' role
Why A: Private pools allow builds to use a VPC network. To access private Artifact Registry, the pool must be in the same VPC as the registry endpoint (which uses Private Service Connect or VPC peering), and the service account must have permission to read from the registry.
Variation 5. A company wants to migrate their on-premises PostgreSQL database to Cloud SQL using DMS. The source database is behind a firewall and does not have a public IP. The target Cloud SQL instance uses a private IP. How should the engineer connect the source to DMS?
easy- A.Assign a public IP to the source database.
- B.Use DMS with a connection profile that specifies the source's private IP without any network configuration.
- ✓ C.Use a VPN or VPC peering to connect the source network to the GCP VPC.
- D.Configure Cloud SQL Auth Proxy on the source.
Why C: For private connectivity, VPC peering between the source network and GCP VPC is required. Cloud SQL Auth Proxy is for connecting to Cloud SQL, not for source.
Last reviewed: Jul 4, 2026
This PCDE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCDE exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.