You have a non-critical business application running on Google Kubernetes Engine (GKE) in the app-dev VPC. You have created an AlloyDB cluster with Private Service Access (PSA) and no public IP addres

Question

Options

• ASet up a high availability VPN between the app-dev and db-dev VPCs. Connect the application
• BConnect by using the private IP address of the AlloyDB cluster directly from the application.
• CConnect by using AlloyDB Auth Proxy installed in the GKE cluster.
• DInstall a SOCKS proxy in a VM in the db-dev VPC. Install AlloyDB Auth Proxy in your GKE cluster,

Explanation

The correct answer is C. AlloyDB Auth Proxy installed in the GKE cluster is the Google-recommended, secure, and cost-effective connectivity method. Auth Proxy provides IAM-based authentication (eliminating the need to manage SSL certificates or database credentials manually) and encrypts all traffic between the application and AlloyDB. VPC peering between app-dev and db-dev VPCs establishes the required network path at no additional cost. Option A (HA VPN) is significantly more expensive and over-engineered for same-cloud VPC communication. Option B (direct private IP) lacks IAM-level authentication, relying solely on network-layer security. Option D (SOCKS proxy + Auth Proxy) is unnecessarily complex and adds extra infrastructure cost and maintenance overhead.

No community discussion yet for this question.