Google Professional Cloud Database Engineer Question 108
Select 2Google Cloud PlatformYou are managing a Cloud SQL instance for your organization. A new team member requires read-only access to the database for running queries. To ensure security and follow the principle of least privilege, what actions should you take?
- A
Create a new database user for the team member and grant them the 'READER' role at the database level.
- B
Grant the team member the 'roles/cloudsql.viewer' IAM role at the project level.
- C
Enable the 'Allow only SSL connections' option for the Cloud SQL instance and provide the team member with the SSL client certificate.
- D
Add the team member to the 'roles/cloudsql.admin' IAM role to simplify access management.
- E
Grant the team member SELECT privileges on the required database tables only.
Show answer and explanation
Correct answers: A, E
Explanation
To manage database users securely and follow the principle of least privilege, it is important to grant only the necessary permissions at the appropriate level. Creating a database user with a read-only role or granting SELECT privileges on specific tables achieves this goal. The other options either provide excessive permissions, do not meet the requirement for database-level access, or address unrelated security features.
- A. Correct.
Correct: Creating a new database user and granting the 'READER' role ensures the team member has access limited to read operations at the database level. This aligns with the principle of least privilege.
- B. Incorrect.
Incorrect: The 'roles/cloudsql.viewer' IAM role allows monitoring of Cloud SQL instances but does not provide database-level access or query permissions.
- C. Incorrect.
Incorrect: Enabling SSL improves security but does not control user permissions or provide read-only access. SSL is a connection-level security feature, not a privilege management solution.
- D. Incorrect.
Incorrect: The 'roles/cloudsql.admin' IAM role grants full administrative access to all Cloud SQL instances in the project, which violates the principle of least privilege.
- E. Correct.
Correct: Granting SELECT privileges on specific tables ensures the team member only has access to the data they need, providing fine-grained control over their permissions.