GCP Professional Cloud Architect Practice Question

A Cloud Run (fully managed) service deployed in europe-west1 must connect to an internal-only PostgreSQL VM that listens on 10.20.4.5 inside the project's custom VPC subnet 10.20.4.0/24. Security policy forbids assigning external IP addresses to either workload or allowing any outbound traffic over the public internet. The service currently times-out when it opens a TCP connection to 10.20.4.5. What single configuration change will enable the service to reach the database while satisfying the policy and without modifying the container image?

Create a Serverless VPC Access connector in europe-west1 using a non-overlapping /28 CIDR, attach it to the Cloud Run service, and add a firewall rule that permits traffic from the connector's IP range to 10.20.4.5.
Enable Private Google Access on the subnet that hosts the PostgreSQL VM so Cloud Run can resolve and reach the VM's private address.
Configure VPC Network Peering between the Cloud Run service and the custom VPC and rely on the default egress range.
Enable Cloud NAT on the subnet and set the Cloud Run service's egress setting to All traffic so the service can reach the VM via the NAT gateway.

Report Issue

Answer Description

Cloud Run instances run on Google-managed infrastructure that is not automatically part of your VPC. To reach private RFC 1918 addresses you must route traffic through a Serverless VPC Access connector located in the same region as the service. The connector allocates a dedicated /28 (or larger) address range that must not overlap existing subnets; packets from Cloud Run appear to originate from this range. After attaching the connector to the Cloud Run service and permitting traffic from the connector range to the database subnet, the connection stays on the private network and no external IPs or public internet paths are used.

Network peering is unsupported for Cloud Run's underlying service project, Private Google Access only affects access to Google APIs, and Cloud NAT handles outbound internet traffic rather than traffic to internal VM addresses, so those alternatives would not meet the requirement.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.