You are developing an Apache Beam pipeline to extract data from a Cloud SQL instance by using JdbcIO. You have two projects running in Google Cloud. The pipeline will be deployed and executed on…

Question

Options

• ASet up VPC Network Peering between Project A and Project B. Add a firewall rule to allow the peered subnet range to access all instances on the network.
• BTurn off the external IP addresses on the Dataflow worker. Enable Cloud NAT in Project A.
• CAdd the external IP addresses of the Dataflow worker as authorized networks in the Cloud SQL instance.
• DSet up VPC Network Peering between Project A and Project B. Create a Compute Engine instance without external IP address in Project B on the peered

• A
  79% (22)
• B
  4% (1)
• C
  4% (1)
• D
  14% (4)

Explanation

Option A is correct because VPC Network Peering establishes a private network path between Project A and Project B, allowing Dataflow workers to reach the Cloud SQL private IP address without traffic traversing the public internet. The firewall rule is required to permit ingress from the peered subnet CIDR to the Cloud SQL instance's port (typically 3306).

Why the distractors are wrong:

• B - Removing external IPs and enabling Cloud NAT keeps traffic within Project A but does nothing to create a private path into Project B's network where Cloud SQL lives; NAT is for outbound internet traffic, not cross-project private routing.
• C - Adding Dataflow worker IPs as authorized networks in Cloud SQL would technically work, but it routes traffic over the public internet (since authorized networks use public IPs), which violates the "no public internet" requirement.
• D - This is an incomplete option (likely cut off), but a proxy Compute Engine instance in Project B is the Cloud SQL Auth Proxy pattern - it's a valid approach in some scenarios, but unnecessary complexity when peering alone suffices, and the option as written is truncated/invalid.

Memory tip: Think of VPC Peering as "building a private bridge between two houses (projects)" - once the bridge exists, you still need to unlock the door (firewall rule). Any answer that routes through public IPs (NAT, authorized networks) automatically fails a "no public internet" constraint.

No community discussion yet for this question.