Welcome to ExamTopics
ExamTopics Logo
- Expert Verified, Online, Free.

Unlimited Access

Get Unlimited Contributor Access to the all ExamTopics Exams!
Take advantage of PDF Files for 1000+ Exams along with community discussions and pass IT Certification Exams Easily.

Exam Professional Cloud Architect topic 1 question 53 discussion

Actual exam question from Google's Professional Cloud Architect
Question #: 53
Topic #: 1
[All Professional Cloud Architect Questions]

You are deploying an application on App Engine that needs to integrate with an on-premises database. For security purposes, your on-premises database must not be accessible through the public internet. What should you do?

  • A. Deploy your application on App Engine standard environment and use App Engine firewall rules to limit access to the open on-premises database.
  • B. Deploy your application on App Engine standard environment and use Cloud VPN to limit access to the on-premises database.
  • C. Deploy your application on App Engine flexible environment and use App Engine firewall rules to limit access to the on-premises database.
  • D. Deploy your application on App Engine flexible environment and use Cloud VPN to limit access to the on-premises database.
Show Suggested Answer Hide Answer
Suggested Answer: D 🗳️

Comments

Chosen Answer:
This is a voting comment (?) , you can switch to a simple comment.
Switch to a voting comment New
MyPractice
Highly Voted 4 years, 6 months ago
Agree with D - "When to choose the flexible environment" "Accesses the resources or services of your Google Cloud project that reside in the Compute Engine network." https://cloud.google.com/appengine/docs/the-appengine-environments
upvoted 49 times
AWS56
4 years, 5 months ago
Why not B ? https://cloud.google.com/appengine/docs/flexible/python/using-third-party-databases
upvoted 6 times
areza
3 years ago
because app engine standard cant connect to on-prem db
upvoted 26 times
VSMu
1 year, 5 months ago
Where does it say appengine cannot connect to on-prem db? With CloudVPN, it shoudl connect as per this https://cloud.google.com/appengine/docs/flexible/storage-options#on_premises Also going with D will require app to be containerized. That is not listed in the requirement.
upvoted 6 times
Cloudcrawler
10 months, 4 weeks ago
This is the link for Standard Env https://cloud.google.com/appengine/docs/standard/storage-options Both standard and Flexible can connect to a VPC with Serverless VPC connector. Once it connects to a VPC, connecting to onprem is same for any service.
upvoted 4 times
jrisl1991
9 months ago
I just had the same confusion. Serverless VPC Connector is something relatively newer than this question on the exam, so probably it's safer to assume that a VPC connection is not supported (at least directly) by App Engine Standard. Besides, this would add extra overhead, and would also increase the costs for the solution. Most of these questions haven't been updated or repurposed according to newer products and services. For this particular question, using a Serverless VPC Connector would add unnecessary complexity and the solution would become more expensive. I swore to god it was B lol, but after a few hours of reading the documentation, I changed my mind and switched to option D. You might want to do the same.
upvoted 2 times
...
...
...
...
elaineshi
2 years, 1 month ago
Isn't the question said "not public internet access"?
upvoted 1 times
mnsait
1 month, 2 weeks ago
Yes, that phrase in the question bothers me too. However, when I check this: https://cloud.google.com/appengine/docs/flexible/storage-options#:~:text=On%20premises,-If%20you%20have&text=Because%20App%20Engine%20and%20Compute,database%20server's%20internal%20IP%20address. it says "If you have existing on-premises databases that you want to make accessible to your App Engine app, you can either configure your internal network and firewall to give the database a public IP address or connect using a VPN." So I think the question should have skipped the words "not public internet access" if they want us to choose VPN.
upvoted 1 times
...
...
haroldbenites
2 years, 7 months ago
In a forum mentions that GCE and CAP flex are designed for connect to VPC . With GAP standard is needed a proxy . https://stackoverflow.com/questions/47537204/how-to-connect-app-engine-and-on-premise-server-through-vpn
upvoted 5 times
...
...
...
jcmoranp
Highly Voted 4 years, 8 months ago
Right is D: https://stackoverflow.com/questions/37137914/is-it-possible-to-use-google-app-engine-with-google-cloud-vpn
upvoted 18 times
amxexam
2 years, 1 month ago
Question is can we restrict acess with VP N ?
upvoted 4 times
moiradavis
1 year, 11 months ago
The stackoverflow reference if older that the answer (6 years) I think that has changed.
upvoted 1 times
...
...
...
neha_pallod
Most Recent 1 day, 4 hours ago
Selected Answer: B
right answer is B
upvoted 1 times
...
nhatne
1 week, 1 day ago
Selected Answer: D
"your on-premises database must not be accessible through the public internet" => definitely C
upvoted 1 times
nhatne
1 week, 1 day ago
sorry was a typo, It's D
upvoted 1 times
...
...
gustangelo
1 month, 1 week ago
Selected Answer: B
The documentation mentions that App Engine Standard can connect to on-prem database using VPN. Link of the documentation: https://cloud.google.com/appengine/docs/standard/storage-options
upvoted 3 times
...
pico
1 month, 3 weeks ago
Selected Answer: B
now you can use option B
upvoted 3 times
...
valgorodetsky
2 months ago
Selected Answer: B
you can use a Serverless VPC Connector to connect App Engine Standard Environment to an on-premise resource via Cloud VPN
upvoted 3 times
...
Diwz
3 months ago
Selected Answer: D
https://cloud.google.com/appengine/docs/flexible/flexible-for-standard-users Standard environment tend to be stateless web applications . Flexi is better for intergrating with on premise database
upvoted 4 times
...
didek1986
5 months, 2 weeks ago
Selected Answer: B
It is B
upvoted 3 times
...
Teckexam
5 months, 2 weeks ago
Selected Answer: B
B. As per documentation https://cloud.google.com/appengine/docs/flexible/storage-options. Clearly App Engine standard can connect to on prem database.
upvoted 3 times
sidiosidi
2 months, 1 week ago
correct, the link is https://cloud.google.com/appengine/docs/standard/connecting-vpc
upvoted 1 times
...
glb2
3 months, 2 weeks ago
I believe that above link treats about Flexible env. - even URL contains "flexible" part.
upvoted 2 times
glb2
3 months, 2 weeks ago
Ok, for Standard is exactly the same statement.
upvoted 1 times
...
...
...
cfigueiredo
5 months, 3 weeks ago
Selected Answer: D
D is correct
upvoted 1 times
Zafar_
5 months, 3 weeks ago
Explain?
upvoted 2 times
...
...
odacir
7 months, 2 weeks ago
Selected Answer: B
I vote B, flexible is just needed if you need no standard softwere etc... https://cloud.google.com/appengine/docs/flexible/storage-options#on_premises
upvoted 3 times
...
jrisl1991
9 months ago
Selected Answer: D
I had originally chosen option B because both App Engine Standard and App Engine Flex can connect via Cloud VPN starting a few years ago. For App Engine Standard to connect with a VPC (which would be required to use Cloud VPN), we need to create a Serverless VPC Connector (as well as for other Cloud Run and Cloud Functions). This is something relatively new and probably came out after this question was designed for the exam: https://cloud.google.com/vpc/docs/serverless-vpc-access#supported_services. Based on the fact that the Serverless VPC Connector would add extra complexity to the network topology and incur in additional costs, I'm going with D.
upvoted 2 times
...
jrisl1991
9 months ago
Selected Answer: B
I'm going with B based on this: https://cloud.google.com/appengine/docs/standard/storage-options#on_premises. App Engine Standard can connect through an external database via Cloud VPN. The question only states that the on-prem database must not be accessible through the public internet, not that the traffic must NOT traverse the public internet. Quoting the documentation from App Engine Standard: "If you have existing on-premises databases that you want to make accessible to your App Engine app, you can either configure your internal network and firewall to give the database a public IP address or connect using a VPN." Obviously we don't want to give the database a public IP because that would mean it would be accessible via public internet (which is what we want to prevent), and Cloud VPN would help with that.
upvoted 3 times
...
AdityaGupta
9 months ago
Selected Answer: C
Remember On-prem DB is not accessible over internet, hence VPN is out of question. C. Deploy your application on App Engine flexible environment and use App Engine firewall rules to limit access to the on-premises database.
upvoted 1 times
jrisl1991
9 months ago
There's a difference between accessing from Public Internet, and traversing through Public Internet. To ensure that no traffic goes over public internet at all, they should use Dedicated Interconnect, not Cloud VPN. Plus, using Firewall rules would only determine if traffic can ingress or egress via HTTP(S), it doesn't provide any security at all with regards to preventing the traffic from being accessed, corrupted or tampered via public internet (before reaching GCP). Both ChatGPT and Bard suggest B as the correct option too, you might want to have second thoughts about your choice here.
upvoted 1 times
...
...
someone2011
9 months, 1 week ago
Another question https://www.examtopics.com/discussions/google/view/60436-exam-professional-cloud-architect-topic-1-question-151/ States "Your company has a support ticketing solution that uses App Engine Standard. ...You want to enable the App Engine application to communicate with a database that is running in the company's on-premises environment. What should you do?" So this makes B the winner :)
upvoted 2 times
...
heretolearnazure
10 months, 2 weeks ago
D makes more sense
upvoted 2 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
Loading ...
ex Want to SAVE BIG on Certification Exam Prep?
close
ex Unlock All Exams with ExamTopics Pro 75% Off
  • arrow Choose From 1000+ Exams
  • arrow Access to 10 Exams per Month
  • arrow PDF Format Available
  • arrow Inline Discussions
  • arrow No Captcha/Robot Checks
Limited Time Offer
Ends in