Google Professional Cloud Database Engineer Question 43
Select 3Google Cloud PlatformYou are designing a cloud-based application that will connect to a PostgreSQL database hosted on Cloud SQL. The application is deployed on Google Kubernetes Engine (GKE). Which of the following methods should you use to establish a secure connection between the application and the database?
- A
Use a Cloud SQL Auth Proxy sidecar container in the application’s GKE pod.
- B
Allow the application to connect directly using the public IP of the Cloud SQL instance with SSL enabled.
- C
Enable private IP for the Cloud SQL instance and connect using the instance’s private IP.
- D
Create a service account key file and store it in the application code for authentication.
- E
Use IAM database authentication to connect without storing credentials in the application.
Show answer and explanation
Correct answers: A, C, E
Explanation
When connecting an application hosted on GKE to a Cloud SQL PostgreSQL instance, using secure and recommended methods is critical. The Cloud SQL Auth Proxy provides secure connectivity and authentication, while using private IP ensures traffic remains within Google’s network. IAM database authentication eliminates the need to manage credentials manually. Avoid storing service account keys in code to minimize security risks, and avoid public IP exposure unless absolutely necessary.
- A. Correct.
Using the Cloud SQL Auth Proxy is recommended for secure and seamless authentication and encryption when connecting GKE applications to Cloud SQL databases.
- B. Incorrect.
While connecting via the public IP with SSL enabled can provide security, it is less secure than private IP or the Cloud SQL Auth Proxy and exposes the instance to potential public access.
- C. Correct.
Enabling private IP for the Cloud SQL instance and connecting through private IP ensures that the traffic remains within Google’s network, enhancing security and reducing latency.
- D. Incorrect.
Storing a service account key file in the application code is not recommended as it poses a significant security risk if the key file is accidentally exposed.
- E. Correct.
IAM database authentication is a secure option that allows you to avoid storing credentials in the application, leveraging Google Cloud's IAM to authenticate users.