Google Professional Cloud Database Engineer Question 44
Single answerGoogle Cloud PlatformYou are designing the architecture for a new e-commerce application that needs to connect to a Google Cloud SQL database. The application will run on Google Kubernetes Engine (GKE) and must securely connect to the database without exposing credentials in the application code. What is the best approach to ensure secure connectivity?
- A
Use the Cloud SQL Auth Proxy to establish a secure connection between the application and the database.
- B
Store the database credentials in a ConfigMap on GKE and use them to connect to the database.
- C
Allowlist the GKE nodes' IP ranges in the Cloud SQL instance and use native database credentials.
- D
Use a VPN to connect the GKE cluster to the Cloud SQL instance and use database credentials stored in the application code.
Show answer and explanation
Correct answer: A
Explanation
The Cloud SQL Auth Proxy is the recommended approach for securely connecting applications to Cloud SQL databases. It eliminates the need for hardcoded credentials by leveraging Google IAM for authentication and ensures encrypted connections between the application and the database. This approach follows best practices for security and scalability.
- A. Correct.
This is the correct option because the Cloud SQL Auth Proxy simplifies and secures database connectivity by handling authentication using Google IAM roles without requiring hardcoded credentials.
- B. Incorrect.
Using a ConfigMap to store credentials is not secure, as ConfigMaps are not encrypted by default and can expose sensitive information if improperly handled.
- C. Incorrect.
Allowlisting IP ranges can work but is less secure and scalable compared to the Cloud SQL Auth Proxy. It also requires managing IP changes and exposes the database to potential risks.
- D. Incorrect.
Using a VPN increases complexity and still relies on hardcoded credentials in the application code, which is not a recommended practice for securing database connections.