Google Professional Cloud Database Engineer Question 45
Single answerGoogle Cloud PlatformYou are designing a cloud-native application that will connect to a Cloud SQL PostgreSQL database hosted on Google Cloud. The application is deployed on Google Kubernetes Engine (GKE) and requires a secure and efficient connection to the database. Which of the following solutions would best address this requirement?
- A
Use a private IP address for the Cloud SQL instance and configure the GKE cluster to connect to it via VPC peering.
- B
Use the Cloud SQL Auth Proxy to establish a secure connection between the application and the database.
- C
Enable the public IP of the Cloud SQL instance and configure GKE to connect to it using SSL encryption.
- D
Use a self-managed VPN solution to connect the GKE cluster to the Cloud SQL database.
Show answer and explanation
Correct answer: B
Explanation
The Cloud SQL Auth Proxy is the best solution for this scenario because it simplifies secure connections to Cloud SQL instances by managing authentication and encryption seamlessly. It integrates with Google Cloud IAM, providing robust security without requiring additional networking configuration or exposing the database to public access. Other options either introduce complexity or increase security risks, making them less ideal for this use case.
- A. Incorrect.
Using a private IP address with VPC peering is a valid option for connecting to Cloud SQL securely. However, this option requires additional VPC networking setup and does not directly handle authentication for the application, unlike the Cloud SQL Auth Proxy.
- B. Correct.
The Cloud SQL Auth Proxy is specifically designed to provide a secure connection to Cloud SQL databases. It handles IAM-based authentication and encrypts the connection, making it a highly efficient and secure choice for cloud-native applications.
- C. Incorrect.
Enabling a public IP for the Cloud SQL instance and using SSL encryption can secure the connection, but it exposes the database to the public internet, which increases the attack surface and is not recommended for production workloads.
- D. Incorrect.
A self-managed VPN solution is unnecessary in this scenario because Google Cloud provides native features like VPC peering, private IPs, and the Cloud SQL Auth Proxy to secure connections efficiently without the overhead of managing a VPN.