I85PREP
⌘ K
ACE-Professional study materials
ACE-Professional study resources

ACE-Professional practice questions

One question at a time. Build your ACE-Professional understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cloud Concepts and Architecture

Which characteristic of cloud computing allows a customer to provision additional compute capacity during a traffic spike without a long procurement cycle?

  1. Measured service
  2. Resource pooling
  3. Rapid elasticity Correct answer.
  4. Multi-tenancy

Explanation

Rapid elasticity means capacity can be scaled outward and inward on demand, closely matching supply to current demand. It removes the manual, long-lead-time procurement that on-premises hardware requires.

Question 2Cloud Concepts and Architecture

A company wants to move from large upfront capital purchases of servers to paying a monthly fee based on usage. Which cloud benefit does this describe?

  1. Vendor lock-in avoidance
  2. Operational expenditure model Correct answer.
  3. High availability design
  4. Geographic redundancy

Explanation

Consuming IT as an operating expense converts capital expenditure into variable, usage-based spending. This aligns cost with actual consumption rather than with upfront asset ownership.

Question 3Cloud Concepts and Architecture

Which service model requires the customer to manage the operating system, runtime, and application while the provider manages the virtualization layer and hardware?

  1. Infrastructure as a Service Correct answer.
  2. Software as a Service
  3. Function as a Service
  4. Platform as a Service

Explanation

In IaaS the provider supplies compute, storage, and networking, while the customer retains control of the guest operating system and everything above it. PaaS and SaaS push more of that management burden onto the provider.

Question 4Cloud Concepts and Architecture

Which cloud deployment model places workloads on infrastructure dedicated to a single organization but hosted and operated by a third party?

  1. Community cloud
  2. Hybrid cloud
  3. Private cloud Correct answer.
  4. Public cloud

Explanation

A private cloud provides infrastructure used exclusively by one organization, and it may be operated by a third party on or off the organization's premises. Exclusivity of use, not ownership of the data center, defines it.

Question 5Cloud Concepts and Architecture

Which statement best describes a benefit of loosely coupling application components in a cloud architecture?

  1. A failure in one component is less likely to cascade to others Correct answer.
  2. Components must share a single relational database
  3. All components must run on the same physical host
  4. Every component must be deployed as a single unit

Explanation

Loose coupling reduces direct dependencies between components, so a fault or slowdown in one is contained rather than propagated. This containment improves resilience and allows independent scaling and deployment.

Question 6Cloud Concepts and Architecture

What is the primary purpose of a content delivery network in a cloud architecture?

  1. Encrypting data at rest in object storage
  2. Caching content at edge locations close to users Correct answer.
  3. Metering API calls for billing
  4. Provisioning virtual machines on demand

Explanation

A CDN caches content at geographically distributed edge locations so users retrieve it from a nearby point of presence. This reduces latency and offloads origin servers.

Question 7Cloud Concepts and Architecture

Which cloud concept describes the ability to recover a workload in a second region after a regional outage?

  1. Vertical scaling
  2. Disaster recovery Correct answer.
  3. Auto-scaling
  4. Load balancing

Explanation

Disaster recovery is the set of strategies and processes for restoring workloads after a major failure such as a regional outage. It is typically expressed through recovery point and recovery time objectives.

Question 8Cloud Concepts and Architecture

In the shared responsibility model for a public cloud, which task always remains the customer's responsibility regardless of service model?

  1. Classifying and protecting the data they store Correct answer.
  2. Maintaining the physical data center
  3. Replacing failed physical disks
  4. Securing the hypervisor layer

Explanation

The provider secures the physical and virtualization layers, but the customer always owns decisions about their data, including classification, access control, and protection. This responsibility does not transfer to the provider in any service model.

Question 9Cloud Concepts and Architecture

A team needs a managed service that automatically distributes incoming requests across multiple healthy web servers. Which component should they use?

  1. A relational database read replica
  2. A message queue
  3. A virtual private network gateway
  4. A load balancer with health checks Correct answer.

Explanation

A load balancer distributes traffic across a target group and uses health checks to route only to healthy instances. This provides both traffic distribution and automatic removal of failed targets.

Question 10Cloud Concepts and Architecture

An application writes events to a queue that workers process asynchronously. Which design goal does this primarily achieve?

  1. Removing the need for authentication
  2. Eliminating the need for monitoring
  3. Guaranteeing exactly-once processing by default
  4. Decoupling producers from consumers during demand spikes Correct answer.

Explanation

A queue buffers events so producers can continue without waiting for consumers, absorbing bursts and decoupling the two tiers. Consumers then process at their own sustainable rate.

Question 11Cloud Concepts and Architecture

A workload runs on a fixed number of instances and must survive the loss of a single data center within a region. Which approach best meets this requirement?

  1. Run all instances on a single large host
  2. Spread instances across multiple availability zones Correct answer.
  3. Use a single instance with a larger instance type
  4. Place all instances in one availability zone

Explanation

Availability zones are isolated data center groupings within a region, so distributing instances across zones removes a single point of failure. The workload must also be fronted by load balancing and health checks to shift traffic.

Question 12Cloud Concepts and Architecture

A company must keep certain regulated data within national borders while still using a public cloud for other workloads. Which design approach satisfies this?

  1. Replicate the regulated data to every region for durability
  2. Encrypt the regulated data and store it in any region
  3. Store the regulated data in the provider's global edge cache
  4. Constrain the regulated workload to a region in the required country Correct answer.

Explanation

Regional placement controls where data is stored and processed, so selecting a region inside the required jurisdiction meets the residency requirement. Encryption alone does not change where data physically resides.

Question 13Cloud Concepts and Architecture

Which scenario is the strongest candidate for moving to a serverless function architecture?

  1. A workload requiring kernel-level tuning
  2. A long-running stateful database engine
  3. A legacy application needing full OS control
  4. Short-lived, event-driven tasks with sporadic traffic Correct answer.

Explanation

Serverless functions suit brief, event-triggered work that scales to zero when idle, avoiding cost for unused capacity. Workloads needing OS access or persistent state fit poorly.

Question 14Cloud Concepts and Architecture

A web tier must scale out automatically when average CPU utilization exceeds 70 percent. Which service configuration accomplishes this?

  1. A DNS record with a longer time to live
  2. A static reservation of a fixed instance count
  3. A storage lifecycle rule
  4. A scaling policy tied to a CPU utilization metric with a target value Correct answer.

Explanation

Target tracking or step scaling policies evaluate a metric such as CPU utilization and adjust capacity to keep the metric near the target. This ties capacity to observed demand rather than a fixed count.

Question 15Cloud Concepts and Architecture

Which architecture pattern improves read scalability for a read-heavy application with a relational database?

  1. Sending all reads and writes to a single primary node
  2. Adding read replicas and directing read queries to them Correct answer.
  3. Storing the database on instance-local ephemeral disk
  4. Increasing the write capacity of the primary only

Explanation

Read replicas maintain copies of the primary database that serve read traffic, spreading read load across multiple nodes. Writes still go to the primary, so this pattern helps read-heavy workloads specifically.

Question 16Cloud Concepts and Architecture

What is the difference between a recovery point objective and a recovery time objective?

  1. RPO applies only to databases; RTO applies only to networks
  2. RPO measures backup storage cost; RTO measures compute cost
  3. RPO bounds acceptable data loss; RTO bounds acceptable downtime Correct answer.
  4. RPO bounds acceptable downtime; RTO bounds acceptable data loss

Explanation

The recovery point objective defines how far back in time recovery may restore data, which sets the tolerable amount of lost data. The recovery time objective defines how long restoration may take, setting the tolerable outage duration.

Question 17Cloud Concepts and Architecture

A workload must remain available even if an entire region becomes unavailable. Which strategy provides the strongest continuity?

  1. A single-region deployment with a standby in the same region
  2. An active-passive pair of instances in one availability zone
  3. A single-region deployment with daily backups
  4. An active-active deployment across two regions Correct answer.

Explanation

Active-active across regions serves traffic from multiple regions simultaneously, so losing one region leaves the other already handling load. This avoids the delay of promoting a standby in a different region.

Question 18Cloud Concepts and Architecture

Which statement about availability zones within a cloud region is accurate?

  1. They can only host storage services, not compute
  2. They are isolated from one another but connected by low-latency links Correct answer.
  3. They are located in different countries by design
  4. They share a single power and cooling infrastructure

Explanation

Availability zones are separate fault domains with independent power, cooling, and networking, yet they are linked with low-latency connectivity for replication and failover. This balance supports both isolation and cross-zone architectures.

Question 19Cloud Concepts and Architecture

A team is designing a stateless web tier behind a load balancer. Where should session state be stored?

  1. In a file on the instance's ephemeral disk
  2. In a cookie that the server validates against local memory
  3. In a shared external store such as a cache or database Correct answer.
  4. In the local memory of each web server

Explanation

Stateless instances must not depend on local state, so session data belongs in a shared external store accessible from any instance. This allows the load balancer to route any request to any healthy instance.

Question 20Cloud Concepts and Architecture

Which cloud networking construct isolates resources in a private address space from the public internet while allowing controlled outbound access?

  1. A domain name system record set
  2. A virtual network with private subnets and a NAT gateway Correct answer.
  3. A public subnet with a permissive security group
  4. A content delivery network distribution

Explanation

Private subnets have no direct route to the internet, and a NAT gateway allows outbound-only traffic for updates and API calls. Inbound access from the internet is prevented while egress remains controlled.

Question 21Cloud Concepts and Architecture

An application's traffic is highly predictable, with steady load all day and a nightly batch window that doubles demand. Which cost-optimized capacity approach fits best?

  1. A single fixed instance sized for average load
  2. Spot capacity for the baseline with no fallback
  3. On-demand capacity sized for the peak at all times
  4. Reserved capacity for the baseline plus on-demand capacity for the peak Correct answer.

Explanation

Reserved capacity lowers the unit cost for the predictable baseline, while on-demand or flexible capacity covers the variable peak. This avoids paying premium rates for idle capacity during most of the day.

Question 22Cloud Concepts and Architecture

A company runs a monolithic application on virtual machines and wants to adopt containers. Which benefit most directly justifies the change?

  1. Removal of all operational monitoring requirements
  2. Guaranteed lower cost for every workload
  3. Elimination of the need for networking configuration
  4. Consistent packaging that improves portability across environments Correct answer.

Explanation

Container images package an application with its dependencies, producing consistent behavior from development through production. This portability simplifies promotion across environments and supports finer-grained scaling.

Question 23Cloud Concepts and Architecture

Which design decision most reduces the blast radius of a compromised application credential?

  1. Disabling audit logging to reduce noise
  2. Sharing one administrative role across all components
  3. Embedding long-lived access keys in source code
  4. Granting each component a narrowly scoped role with least privilege Correct answer.

Explanation

Least-privilege roles limit what a compromised credential can do, containing the impact to the permissions that component actually needs. Short-lived, per-component credentials further shrink the window of exposure.

Question 24Cloud Concepts and Architecture

An application must tolerate the loss of an entire availability zone without manual intervention. Which combination of controls is required?

  1. Multi-zone storage with a single-zone compute tier
  2. Automated backups taken once per day
  3. Multi-zone deployment, health-checked load balancing, and automated failover Correct answer.
  4. A single-zone deployment with manual DNS changes

Explanation

Surviving a zone loss requires capacity in other zones, health checks to detect unhealthy targets, and automation to shift traffic without human action. Any one control alone leaves a gap in the recovery path.

Question 25Cloud Concepts and Architecture

A team wants to reduce the risk of vendor lock-in while still using managed cloud services. Which practice best supports that goal?

  1. Using proprietary APIs directly throughout the application code
  2. Isolating provider-specific integrations behind abstraction layers Correct answer.
  3. Hard-coding region-specific endpoints in every service
  4. Storing data only in a provider-proprietary format

Explanation

Abstraction layers confine provider-specific calls to a small part of the system, making migration or multi-provider operation feasible. Portable data formats and configuration-driven endpoints reinforce this separation.

Question 26Cloud Concepts and Architecture

Which statement best describes the relationship between a cloud region and its availability zones?

  1. A region and an availability zone are interchangeable terms for the same physical facility.
  2. A region is a single data center, and availability zones are the racks within it.
  3. A region is a geographic area containing multiple isolated availability zones connected by low-latency links. Correct answer.
  4. An availability zone spans multiple regions and provides global redundancy.

Explanation

A region is a geographic area, and each region contains multiple availability zones that are physically separated but linked by low-latency networking. This separation lets architects design for data center failure within a region.

Question 27Cloud Concepts and Architecture

Which cloud characteristic lets customers add or remove compute capacity in minutes rather than procuring hardware weeks in advance?

  1. Elasticity Correct answer.
  2. Federation
  3. Durability
  4. Multi-tenancy

Explanation

Elasticity is the ability to acquire and release resources on demand to match workload needs. It removes the long procurement cycle associated with physical hardware.

Question 28Cloud Concepts and Architecture

A company wants to pay only for the compute time it actually consumes when running short, event-driven tasks. Which pricing model aligns best with this goal?

  1. A flat monthly fee per provisioned server
  2. Reserved capacity purchased for a multi-year term
  3. Consumption-based billing metered per request and execution duration Correct answer.
  4. A one-time perpetual license per core

Explanation

Consumption-based billing charges for actual usage, such as number of invocations and execution time, which matches sporadic event-driven workloads. Committed or fixed pricing models assume steady, predictable usage.

Question 29Cloud Concepts and Architecture

Which concept describes a cloud provider pooling physical resources so that many customers share the same underlying hardware securely?

  1. Fault tolerance
  2. High availability
  3. Data residency
  4. Multi-tenancy Correct answer.

Explanation

Multi-tenancy is the pooling of physical resources among many customers with logical isolation between them. It underpins the cost efficiency of public cloud.

Question 30Cloud Concepts and Architecture

A team is choosing between block storage and object storage for a workload that stores millions of large media files accessed by URL and rarely modified. Which choice is most appropriate and why?

  1. Object storage, because it attaches directly to a virtual machine as a raw disk.
  2. Block storage, because it offers the lowest cost per gigabyte for large files.
  3. Block storage, because it provides a file system hierarchy for media files.
  4. Object storage, because it scales to massive volumes and is accessed through an API or URL with rich metadata. Correct answer.

Explanation

Object storage is designed for very large numbers of immutable or rarely changed objects accessed over HTTP APIs, with metadata and high durability. Block storage presents raw volumes to a single compute instance and does not scale the same way for this access pattern.

Question 31Cloud Concepts and Architecture

Which cloud service model gives the customer the most control over the operating system and runtime while still abstracting physical hardware?

  1. Platform as a service
  2. Function as a service
  3. Software as a service
  4. Infrastructure as a service Correct answer.

Explanation

Infrastructure as a service provides virtualized compute, storage, and networking while the customer manages the operating system and everything above it. Higher-level models such as PaaS and FaaS abstract the OS away from the customer.

Question 32Cloud Concepts and Architecture

A company wants to connect its on-premises data center to a cloud virtual private network with predictable latency and without traversing the public internet. Which option best meets this requirement?

  1. A dedicated private network connection between the data center and the cloud provider Correct answer.
  2. A site-to-site VPN tunnel over the public internet
  3. A content delivery network edge location
  4. A public-facing load balancer in front of the on-premises servers

Explanation

A dedicated private connection provides a physically or logically private link from the customer's facility to the provider's network, avoiding public internet variability. VPN tunnels still traverse the public internet and cannot guarantee consistent latency.

Question 33Cloud Concepts and Architecture

Which statement accurately distinguishes horizontal scaling from vertical scaling?

  1. Horizontal scaling adds more instances to a pool, while vertical scaling increases the capacity of a single instance. Correct answer.
  2. Horizontal scaling increases the CPU and memory of one server, while vertical scaling adds more servers.
  3. Horizontal scaling requires downtime, while vertical scaling never does.
  4. Horizontal scaling is only possible for databases, while vertical scaling is only for web servers.

Explanation

Horizontal scaling, or scaling out, adds more nodes to distribute load; vertical scaling, or scaling up, enlarges a single node. Horizontal scaling generally supports higher availability because no single large node is a bottleneck.

Question 34Cloud Concepts and Architecture

An architect must ensure that a workload can continue operating if a single physical server hosting a virtual machine fails. Which design element most directly addresses this?

  1. Taking more frequent backups of the instance's disk
  2. Placing multiple instances of the workload across separate hosts and fronting them with a load balancer Correct answer.
  3. Deploying the workload to a single large instance with more memory
  4. Enabling detailed monitoring on the single instance

Explanation

Spreading instances across independent hosts removes the single point of failure and lets the load balancer route around a failed host. Backups and monitoring aid recovery and detection but do not maintain availability during a host failure.

Question 35Cloud Concepts and Architecture

Which practice best protects data confidentiality when storing sensitive objects in cloud object storage?

  1. Relying on the provider's default encryption settings only
  2. Encrypting objects with customer-managed keys and enforcing least-privilege access policies Correct answer.
  3. Making the bucket publicly readable so access logs capture all requests
  4. Storing the data in a single availability zone to limit exposure

Explanation

Customer-managed keys give the organization control over key lifecycle and revocation, while least-privilege policies limit who can read the data. Together they reduce exposure beyond provider defaults.

Question 36Cloud Concepts and Architecture

A team wants to decouple a front-end web application from a backend processing service so that spikes in traffic do not overwhelm the backend. Which architectural approach best achieves this?

  1. Having the front end call the backend synchronously and retry on failure
  2. Adding a read replica to the backend database
  3. Placing a message queue between the front end and backend to buffer requests Correct answer.
  4. Increasing the backend's instance size to handle peak load

Explanation

A queue buffers incoming work so the backend consumes at its own pace, absorbing spikes without dropping requests. Synchronous calls propagate load directly and can fail under pressure.

Question 37Cloud Concepts and Architecture

A workload must survive the loss of an entire region with minimal data loss. Which combination of practices most directly supports this?

  1. Cross-region replication of data and a failover mechanism to a standby environment in another region Correct answer.
  2. A single availability zone deployment with frequent snapshots
  3. Vertical scaling of the primary database in the primary region
  4. Backups stored in the same region and a single-region deployment

Explanation

Cross-region replication keeps a current copy of data outside the failed region, and a failover mechanism lets traffic shift to a standby environment. Both are required to recover from a full regional outage with limited data loss.

Question 38Cloud Concepts and Architecture

An architect is evaluating whether to use a managed relational database service or a self-managed database on virtual machines. Which factor most strongly favors the managed service?

  1. The team wants full control over the database engine's internal configuration files.
  2. The team wants to avoid any dependency on the cloud provider's tooling.
  3. The team needs to install custom kernel modules on the database host.
  4. The team wants to offload patching, backups, and failover management to the provider. Correct answer.

Explanation

Managed database services take on routine operational tasks such as patching, backups, and failover, freeing the team to focus on application concerns. Self-managed databases offer more control but require the team to operate them.

Question 39Cloud Concepts and Architecture

A company is designing a system that must be resilient to the failure of a single dependency. Which pattern best prevents a failing downstream service from exhausting the caller's resources?

  1. Removing timeouts so calls can wait for the dependency to respond
  2. Retrying immediately and indefinitely until the dependency recovers
  3. Applying a circuit breaker that stops calls to the failing dependency and fails fast Correct answer.
  4. Increasing the caller's thread pool without bound

Explanation

A circuit breaker detects repeated failures and short-circuits calls, preventing the caller from tying up resources on a dependency that is already failing. This contains the failure and allows recovery.

Question 40Cloud Concepts and Architecture

An organization wants to reduce the risk of lock-in while adopting managed cloud services. Which approach best supports this goal?

  1. Choosing the provider's proprietary services exclusively to maximize feature depth
  2. Avoiding all managed services and running everything on virtual machines
  3. Committing to long-term reserved contracts to lower unit costs
  4. Favoring open standards and portable interfaces, and isolating provider-specific code behind abstractions Correct answer.

Explanation

Using open standards and wrapping provider-specific integrations behind abstractions lets components be replaced with less rework if the organization changes providers. This balances managed-service benefits with portability.

Question 41Compute and Application Services

Which Google Cloud compute service runs containerized workloads without requiring you to provision or manage the underlying cluster?

  1. App Engine
  2. Cloud Run Correct answer.
  3. Google Kubernetes Engine
  4. Compute Engine

Explanation

Cloud Run is a fully managed serverless platform that executes containers while abstracting away node and cluster management. GKE provides managed Kubernetes but still requires cluster configuration, and Compute Engine exposes raw VMs.

Question 42Compute and Application Services

A team wants to run a batch job that can be preempted and should cost significantly less than a standard VM. Which Compute Engine option fits best?

  1. Spot VMs Correct answer.
  2. Sole-tenant nodes
  3. Custom machine types
  4. Committed use discounts

Explanation

Spot VMs use spare capacity at steep discounts but can be reclaimed at any time, which suits fault-tolerant batch work. Committed use discounts require a term commitment, and sole-tenant nodes serve isolation needs rather than cost reduction.

Question 43Compute and Application Services

Which service is designed to run event-driven functions that scale to zero and respond to triggers such as Pub/Sub messages or Cloud Storage changes?

  1. Batch
  2. Cloud Run services
  3. Managed instance groups
  4. Cloud Functions Correct answer.

Explanation

Cloud Functions is the event-driven serverless functions product that scales to zero and integrates with event sources like Pub/Sub and Cloud Storage. Cloud Run runs containers, and managed instance groups maintain a fixed fleet of VMs.

Question 44Compute and Application Services

What is the primary purpose of an instance template in Compute Engine?

  1. To store SSH keys for all projects in an organization
  2. To configure VPC firewall rules
  3. To define the machine configuration used when creating VMs in a managed instance group Correct answer.
  4. To provide a persistent disk snapshot schedule

Explanation

An instance template captures machine type, image, disk, and metadata settings so that managed instance groups can create identical VMs. It does not manage keys, snapshots, or firewall rules.

Question 45Compute and Application Services

Which App Engine environment supports languages like Python, Java, and Node.js with rapid scale-to-zero behavior?

  1. Standard environment Correct answer.
  2. Anthos environment
  3. Flexible environment
  4. Sole-tenant environment

Explanation

The App Engine standard environment provides sandboxed runtimes with fast scaling, including scale to zero. The flexible environment runs containers on managed VMs and does not scale to zero as readily.

Question 46Compute and Application Services

Which load balancer type operates at Layer 4 and is suited for TCP/UDP traffic?

  1. Regional external passthrough Network Load Balancer Correct answer.
  2. Internal HTTP(S) load balancer
  3. Global external HTTP(S) load balancer
  4. External HTTP(S) load balancer

Explanation

The passthrough Network Load Balancer is a Layer 4 regional load balancer for TCP/UDP traffic. HTTP(S) load balancers operate at Layer 7 and route based on HTTP attributes.

Question 47Compute and Application Services

Which artifact repository service in Google Cloud stores container images and language packages such as Maven and npm?

  1. Container Registry only
  2. Cloud Source Repositories
  3. Artifact Registry Correct answer.
  4. Cloud Storage buckets

Explanation

Artifact Registry is the general-purpose package and container repository supporting formats like Docker, Maven, npm, and Python. Container Registry is the legacy container-only option being superseded.

Question 48Compute and Application Services

What does a Compute Engine managed instance group provide when configured with an autoscaler?

  1. Automatic adjustment of the number of VM instances based on load Correct answer.
  2. Automatic encryption of persistent disks
  3. Automatic assignment of external IP addresses
  4. Automatic patching of guest operating systems

Explanation

An autoscaler on a managed instance group adds or removes VM instances in response to signals like CPU utilization or load balancing capacity. It does not handle OS patching, disk encryption, or IP assignment.

Question 49Compute and Application Services

A company needs to run a stateful database on GKE and must ensure that each replica always reattaches to its own persistent disk. Which Kubernetes resource should they use?

  1. Job with an emptyDir volume
  2. StatefulSet with volumeClaimTemplates Correct answer.
  3. DaemonSet with hostPath volumes
  4. Deployment with a shared PersistentVolume

Explanation

StatefulSets provide stable pod identities and, with volumeClaimTemplates, give each replica its own PersistentVolumeClaim that reattaches on rescheduling. Deployments treat pods as interchangeable and do not guarantee per-pod storage affinity.

Question 50Compute and Application Services

An application running on Cloud Run needs to connect to a Cloud SQL instance privately without exposing the database to the public internet. What is the recommended approach?

  1. Configure the Cloud Run service with a Serverless VPC Access connector and use the instance's private IP Correct answer.
  2. Mount the Cloud SQL data directory as a Cloud Run volume
  3. Assign a public IP to Cloud SQL and restrict access by authorized networks
  4. Use Cloud SQL Auth Proxy with the public IP and no firewall rules

Explanation

Serverless VPC Access connectors let Cloud Run reach private IPs in a VPC, including Cloud SQL private IP addresses. The Cloud SQL Auth Proxy can be combined with this for secure, IAM-based connections.