The correct fix is to use Cloud SQL Proxy, which resolves the public IP connection error by establishing a secure, authenticated tunnel to the Cloud SQL instance without requiring the VM’s public IP to be added to the authorized networks list. The proxy handles IAM-based authentication and TLS encryption, bypassing the public IP network authorization requirement entirely, so even if the VM’s IP is not whitelisted, the connection succeeds. On the Google Professional Cloud Database Engineer exam, this scenario tests your understanding that Cloud SQL Proxy is the preferred method for secure connections from Compute Engine VMs, as it avoids the common trap of manually authorizing ephemeral or dynamic public IPs. A key memory tip: think of the proxy as a “secure bridge” that replaces IP whitelisting with IAM permissions, so you never need to manage authorized networks for individual VMs.
PCDE Plan and manage database infrastructure Practice Question
This PCDE practice question tests your understanding of plan and manage database infrastructure. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Exhibit
2024-04-01 12:00:00 UTC [ERROR] [my-instance] : SSL connection required. Client IP: 192.168.1.1. Instance requires SSL for public connections.
Refer to the exhibit. A developer tries to connect to a Cloud SQL instance from a VM using the public IP. The connection fails with this error. What should the developer do to fix the connection?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Connect using the Cloud SQL Proxy.
The error indicates that the Cloud SQL instance does not have an authorized network allowing the VM's public IP. However, the correct fix is to use the Cloud SQL Proxy, which establishes a secure, authenticated tunnel to the instance without needing to authorize the VM's IP. The proxy handles IAM-based authentication and encryption, bypassing the public IP network authorization requirement entirely.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Enable SSL-only mode on the Cloud SQL instance.
Why it's wrong here
The instance already requires SSL; enabling SSL-only would not change the error.
✗
Add the client IP to the authorized networks.
Why it's wrong here
Authorized networks control firewall access, not SSL enforcement; the connection is blocked due to SSL requirement, not IP.
✓
Connect using the Cloud SQL Proxy.
Why this is correct
The Cloud SQL Proxy handles SSL encryption and IAM authentication, bypassing the need for client-side SSL configuration.
Related concept
Read the scenario before looking for a memorised answer.
✗
Change the instance to require SSL for private connections.
Why it's wrong here
The error is for public connections; changing SSL for private connections has no effect.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Google Cloud often tests the misconception that adding the client IP to authorized networks is the only way to fix a public IP connection failure, but the trap is that the Cloud SQL Proxy is the secure, recommended alternative that avoids IP management and works even when the VM's IP is not static or known.
Detailed technical explanation
How to think about this question
The Cloud SQL Proxy uses a local TCP or Unix socket listener that forwards traffic to the Cloud SQL instance via an encrypted tunnel over HTTPS (port 3307 for MySQL, 5432 for PostgreSQL). It authenticates using IAM roles or service account credentials, eliminating the need to manage IP whitelists. In production, this is critical for ephemeral VMs or autoscaled environments where IPs change frequently.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Plan and manage database infrastructure — This question tests Plan and manage database infrastructure — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Connect using the Cloud SQL Proxy. — The error indicates that the Cloud SQL instance does not have an authorized network allowing the VM's public IP. However, the correct fix is to use the Cloud SQL Proxy, which establishes a secure, authenticated tunnel to the instance without needing to authorize the VM's IP. The proxy handles IAM-based authentication and encryption, bypassing the public IP network authorization requirement entirely.
What should I do if I get this PCDE question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This PCDE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCDE exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.