Google Professional Cloud Database Engineer Question 51
Select 3Google Cloud PlatformYou are tasked with setting up a Cloud SQL instance for a production application. The database must meet the following requirements:
- Ensure secure connections between the application and the database.
- Prevent unauthorized access to the database.
- Encrypt data at rest using a customer-managed encryption key (CMEK).
Which of the following configurations should you implement to meet these requirements?
- A
Use the Cloud SQL Auth Proxy to connect the application to the database.
- B
Enable SSL certificates for client-server connections to the database.
- C
Configure the Cloud SQL instance to use CMEK for data encryption at rest.
- D
Grant the application service account the Cloud SQL Admin role.
- E
Disable private IP for the Cloud SQL instance to restrict access.
Show answer and explanation
Correct answers: A, B, C
Explanation
To meet the requirements, you should use the Cloud SQL Auth Proxy and SSL certificates to secure connections between the application and the database. Configuring CMEK ensures that data at rest is encrypted using a customer-managed encryption key. Granting overly broad roles or disabling private IP does not align with best practices for security and access control.
- A. Correct.
Correct: The Cloud SQL Auth Proxy helps to establish secure, encrypted connections between the application and the database, reducing the risk of unauthorized access.
- B. Correct.
Correct: Enabling SSL certificates ensures that all client-server communication is encrypted, protecting data in transit from interception.
- C. Correct.
Correct: Configuring CMEK ensures that data at rest is encrypted using a customer-managed encryption key, giving you control over encryption and compliance.
- D. Incorrect.
Incorrect: Granting the application service account the Cloud SQL Admin role is not recommended for production environments as it provides overly broad permissions, violating the principle of least privilege.
- E. Incorrect.
Incorrect: Disabling private IP is not recommended as it may expose the Cloud SQL instance to public access when combined with other configurations. Instead, private IP should be enabled for secure, internal communication.