PCNE Implementing a Virtual Private Cloud Practice Question

Correct answer & explanation

Cloud SQL with private IP uses Private Service Access, which requires a VPC peering connection between the VPC and the service producer VPC (Google's). The Cloud SQL instance's private IP is accessible only from the VPC network where the peering is established. However, the issue often arises because the service project does not have the necessary IAM permissions or the VPC peering is set up in the host project but not propagated to service projects. In this case, vm-analytics is in a service project attached to the Shared VPC, so it should have connectivity to the Cloud SQL private IP because it's in the same VPC. But the timeout suggests no route. One common cause is that the Private Service Access connection (VPC peering) is only set up in the host project's VPC, but the service project's VPC (which is actually the same VPC via Shared VPC) may not have routes to the peered network. Actually, when using Shared VPC, the service projects use the host project's VPC, so routes from VPC peering are automatically propagated. However, there is a known issue: if the Cloud SQL instance is created in a service project that is attached to the same Shared VPC, the private service access must be configured in the host project. Also, the service project's service accounts may need the compute.networkUser role on the host project's VPC. The most likely cause is that the VPC peering is set up but the service project's project does not have the necessary IAM role to use the peering. Option C is correct: Grant the service project's compute service account the Compute Network User role on the host project.

Key principle: Count usable hosts — not total addresses — and remember that the network and broadcast addresses are not available to hosts in standard IPv4 subnets.