Examkin

Question

Difficulty: MediumDeploying Serverless Applications with Cloud Run and Cloud Functions

An organization is deploying an internal backend service packaged as a custom Docker container to Google Cloud Run. The service processes sensitive financial transactions and must only accept HTTP requests originating from resources within the same Virtual Private Cloud (VPC) network or VPC Service Controls perimeter. Additionally, unauthenticated public invocations must be prevented. Which `gcloud` command should the Cloud Engineer run to deploy this serverless application according to these security requirements?

  1. Run `gcloud run deploy financial-api --image=gcr.io/my-project/fin-api:v1 --ingress=internal --no-allow-unauthenticated` specifying the target region.Answer
  2. B
    Run `gcloud functions deploy financial-api --image=gcr.io/my-project/fin-api:v1 --ingress-settings=internal-only` specifying the target region.
  3. C
    Run `gcloud run deploy financial-api --image=gcr.io/my-project/fin-api:v1 --ingress=all --allow-unauthenticated` and assign the primitive `roles/editor` role to the default compute service account.
  4. D
    Run `gcloud run deploy financial-api --image=gcr.io/my-project/fin-api:v1 --port=8080` and disable the Cloud Run API in the target project.

Answer

Execute the `gcloud run deploy` command specifying `--ingress=internal` to block public traffic and `--no-allow-unauthenticated` to mandate IAM authentication.
Deploying a container image to Cloud Run with `--ingress=internal` restricts network traffic strictly to internal VPC resources and internal HTTP(S) load balancers. Adding `--no-allow-unauthenticated` ensures callers must present valid GCP identity tokens, fulfilling both network boundary and authentication security requirements.

Step-by-Step Solution

1
Identify the appropriate serverless compute service for pre-built container images.
Cloud Run is selected because it natively executes arbitrary containerized applications.
Cloud Run provides serverless container execution with configurable network ingress controls.
2
Configure network ingress boundaries.
Pass the `--ingress=internal` flag to the `gcloud run deploy` command.
This restricts network access strictly to traffic within the VPC network, internal load balancers, or VPC Service Controls.
3
Configure access control and identity requirements.
Specify the `--no-allow-unauthenticated` flag during deployment.
This prevents unauthenticated public invocations and enforces IAM access evaluation for incoming requests.

Key Concept

Cloud Run Ingress and Authentication Controls
Rate this question

Topics

Deploying Serverless Applications with Cloud Run and Cloud Functions