Google Professional Cloud Database Engineer Question 41
Select 3Google Cloud PlatformYou are designing a cloud-based application that needs to connect to a Cloud SQL database for transactional workloads. The application runs in Google Kubernetes Engine (GKE). Which of the following options are the most secure and recommended ways to establish a connection to the Cloud SQL instance?
- A
Use the Cloud SQL Auth Proxy to manage authentication and connect to the database.
- B
Expose the Cloud SQL database to the public internet and use a public IP to connect from GKE.
- C
Enable private IP for the Cloud SQL instance and configure the GKE cluster to use VPC peering for private connectivity.
- D
Use hardcoded credentials stored in the application code to authenticate with the Cloud SQL instance.
- E
Leverage IAM roles on GKE workloads to authenticate with Cloud SQL using the Cloud SQL Auth Proxy.
Show answer and explanation
Correct answers: A, C, E
Explanation
The most secure and recommended ways to connect applications running in GKE to Cloud SQL are to use the Cloud SQL Auth Proxy, enable private IP for private connectivity, and leverage IAM roles for authentication. These practices ensure secure, manageable, and scalable database connectivity while following Google Cloud's security best practices. Avoid exposing the database to the public internet or hardcoding credentials in application code, as these pose significant security risks.
- A. Correct.
Using the Cloud SQL Auth Proxy is a secure and recommended way to manage authentication and connectivity between applications and Cloud SQL. It ensures encrypted connections and integrates with IAM for secure access.
- B. Incorrect.
Exposing the Cloud SQL database to the public internet is not recommended as it increases the attack surface and poses security risks.
- C. Correct.
Enabling private IP for Cloud SQL and configuring VPC peering allows secure, private connectivity between the database and GKE workloads without exposing traffic to the public internet.
- D. Incorrect.
Hardcoding credentials in application code is a security anti-pattern. It increases the risk of credential exposure and is not recommended.
- E. Correct.
Using IAM roles in conjunction with the Cloud SQL Auth Proxy is a secure practice, as it enables workload identity and avoids the need for hardcoded credentials.