Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Last updated
Your company runs containerized backend workloads on Cloud Run in the us-central1 region. These serverless applications must communicate securely with the following resources:
All traffic between Cloud Run, the internal VMs, and Google APIs must traverse the VPC network without being routed over the public internet.
How should you configure the Cloud Run networking architecture to satisfy these requirements?
Create an internal Application Load Balancer with a Private Service Connect backend NEG, and configure Cloud Run ingress to internal-and-cloud-load-balancing.
Create a Serverless VPC Access connector in us-central1 attached to the VPC network, configure the Cloud Run service to use the connector, and set the VPC egress setting to Route all traffic to the VPC.
Configure a Cloud NAT gateway on the VPC subnet, associate the subnet with Cloud Run, and enable Private Google Access on the subnet without provisioning a connector.
Create a Serverless VPC Access connector in us-central1 attached to the VPC network, configure the Cloud Run service to use the connector, and keep the default VPC egress setting to Route only requests to private IPs to the VPC.
Create an internal Application Load Balancer with a Private Service Connect backend NEG, and configure Cloud Run ingress to internal-and-cloud-load-balancing.
Create a Serverless VPC Access connector in us-central1 attached to the VPC network, configure the Cloud Run service to use the connector, and set the VPC egress setting to Route all traffic to the VPC.
Serverless VPC Access allows serverless environments—such as Cloud Run, Cloud Functions, and App Engine—to initiate outbound connections to private resources in a Google Cloud Virtual Private Cloud (VPC) network. When creating a connector, it provisions lightweight connector VM instances inside an allocated subnet or CIDR range within your VPC.
StudyCerts
StudyCertsall-traffic). This guarantees that packets destined for non-RFC 1918 internal endpoints pass through the connector and into the VPC routing table rather than escaping directly to the public internet.This approach directly satisfies the need for private VPC connectivity while accommodating the architectural requirement of Private Service Connect endpoints assigned privately used external IP spaces.
Configure a Cloud NAT gateway on the VPC subnet, associate the subnet with Cloud Run, and enable Private Google Access on the subnet without provisioning a connector.
Create a Serverless VPC Access connector in us-central1 attached to the VPC network, configure the Cloud Run service to use the connector, and keep the default VPC egress setting to Route only requests to private IPs to the VPC.