Exam Professional Cloud Database Engineer topic 1 question 148 discussion

Actual exam question from Google's Professional Cloud Database Engineer

Question #: 148
Topic #: 1

[All Professional Cloud Database Engineer Questions]

You have a non-critical business application running on Google Kubernetes Engine (GKE) in the app-dev VPC. You have created an AlloyDB cluster with Private Service Access (PSA) and no public IP address in the db-dev VPC. You want your application to securely connect to AlloyDB in a cost-effective way. What should you do?

A. Set up a high availability VPN between the app-dev and db-dev VPCs. Connect the application directly to AlloyDB.
B. Connect by using the private IP address of the AlloyDB cluster directly from the application.
C. Connect by using AlloyDB Auth Proxy installed in the GKE cluster.
D. Install a SOCKS proxy in a VM in the db-dev VPC. Install AlloyDB Auth Proxy in your GKE cluster, and connect to the AlloyDB cluster through the SOCKS server and port.

Show Suggested Answer

Suggested Answer: C 🗳️

by krop at May 12, 2025, 12:09 a.m.

Comments

Submit Cancel

Skywatch

1 month, 2 weeks ago

Selected Answer: C

Connect by using AlloyDB Auth Proxy installed in the GKE cluster. Feasibility: This is the ideal solution. The AlloyDB Auth Proxy is a client-side tool that provides secure access to AlloyDB instances without needing a public IP or direct network connectivity via VPN/Peering. How it works: You run the proxy as a sidecar container in your GKE pods. The proxy uses Google Cloud APIs to create a secure, encrypted tunnel directly to your AlloyDB instance. Your application simply connects to the proxy on localhost, and the proxy handles the secure forwarding of traffic. Security: This is the most secure method. It uses IAM permissions for authentication and authorization and automatically encrypts all traffic with TLS 1.3. Cost-Effectiveness: The proxy itself is free. It completely eliminates the need for expensive VPN gateways or complex VPC Peering configurations, making it the most cost-effective solution.

upvoted 1 times

...

syffuf

2 months, 3 weeks ago

Selected Answer: C

https://cloud.google.com/alloydb/docs/quickstart/integrate-kubernetes

upvoted 2 times

...

krop

3 months, 1 week ago

Selected Answer: B

Private Service Access (PSA) establishes a private connection between your VPC and the Google-managed service network where AlloyDB resides. This allows resources in your VPC (such as GKE pods) to communicate with AlloyDB using its private IP, without needing public IPs or VPNs

upvoted 1 times

syffuf

2 months, 3 weeks ago

But are different VPCs: PSA as created on db-dev

upvoted 2 times

krop

2 months, 3 weeks ago

To be fair, i think this question is incorrectly described here - You have 1st VPC with GKE and you have Managed Database visible in 2nd VPC with its private IP because of PSA. As you mentioned these two VPCs are not connected at all and communication won't be possible between them. I think i have to admit, option C might be the answer here.

upvoted 1 times

...

nubpirogrammer

2 months, 3 weeks ago

Can you check questions from 133 to 147 questions as well

upvoted 1 times

...