How to Securely Host Databases Without Direct Internet Access?

PCSE By islever Editorial Last updated Sep 7, 2026

Short answer

C Create a VPC with a private subnet and assign private IP addresses to each database server.

Question

You want to set up a secure, internal network within Google Cloud for database servers. The servers must not have any direct communication with the public internet. What should you do?

Assign a private IP address to each database server. Use a NAT gateway to provide internet connectivity to the database servers.
Assign a static public IP address to each database server. Use firewall rules to restrict external access.
Create a VPC with a private subnet. Assign a private IP address to each database server. Correct Answer
Assign both a private IP address and a public IP address to each database server.

Key Takeaways

Tests understanding of VPC subnetting and network isolation; the common trap is overcomplicating the design with NAT when the requirement only mandates preventing direct internet access.

Setting up isolated database servers in Google Cloud requires a private VPC subnet with private IP addresses to ensure zero direct internet exposure. While some candidates debate NAT egress, the exam prioritizes strict network isolation and least-privilege architecture for sensitive workloads.

Common mistake: Candidates frequently select the NAT option by fixating on the word “direct,” incorrectly assuming indirect internet access is required or preferred for databases.

Expert Analysis

Why the Answer Is Correct

Creating a VPC with a private subnet and assigning private IP addresses (Option C) establishes a fully isolated environment that inherently prevents any direct communication with the public internet. This aligns with Google Cloud security best practices and the principle of least privilege, ensuring database servers remain inaccessible from external networks without unnecessary egress configurations.

Why the Other Options Are Wrong

Option A introduces a NAT gateway, which grants indirect internet access that the question never requests and contradicts database security standards. Option B assigns public IPs, violating the core isolation requirement despite firewall restrictions. Option D exposes servers to the internet entirely, eliminating network-level security controls.

Community Comment Notes

The discussion heavily centers on the word “direct,” with several users arguing for NAT while others correctly emphasize that private subnets naturally block direct traffic. Comment [4] highlights the poor wording but reinforces that real-world security demands zero internet exposure, validating Option C as the architecturally sound choice. Comments [1] and [2] show how test-takers get distracted by semantic traps rather than focusing on baseline networking principles.

Official Reference

https://cloud.google.com/vpc/docs/vpc#subnet_types

This link opens the official vendor documentation in a new tab.

Exam Strategy

Always prioritize the simplest configuration that satisfies the explicit requirement; avoid adding services like NAT unless the scenario explicitly asks for controlled internet egress. Focus on baseline isolation first before layering on connectivity features.

Frequently Asked Questions

Why isn't a NAT gateway required here?

The question only requires preventing direct internet access, which a private subnet handles natively without granting unnecessary egress.

Does 'no direct communication' imply indirect access is allowed?

Exam wording can be tricky, but security best practices dictate databases should have zero internet exposure unless explicitly mandated.

More PCSE FAQ →

Community Votes

56%

44%

56% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

dv1 👍 4

A seems better to me, as the question says "db servers must not have DIRECT access to the internet".
Zek 👍 3 Answered A

I think A because it says "The servers must not have any direct communication with the public internet." Not direct bur suggest can be indirect access to internet
dlenehan 👍 2 Answered A

Allows indirect access to internet. Other options are more focused on direct access.
YourFriendlyNeighborhoodSpider 👍 1 Answered C

If the question wanted you to allow INDIRECT access (like NAT), it should have been clearer about that. Instead, it's leaving room for pointless debate. In real-world best practices, databases should be in a private subnet with zero internet exposure unless absolutely required (e.g., for updates via a controlled egress path). So yeah, the question is badly worded, and people arguing for NAT are just nitpicking "direct" instead of focusing on security principles!!! SO ANSWER "C" MY DEARS!
abdelrahman89 👍 3 Answered C

Answer C

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

← Back to PCSE Study Guide