Google Professional Cloud Database Engineer Question 52
Select 3Google Cloud PlatformYou are tasked with configuring a secure connection to a Cloud SQL instance hosting a PostgreSQL database for an application running on a Compute Engine VM. The database must use customer-managed encryption keys (CMEK), and only authorized applications should connect to the database using encrypted connections. Which steps should you take to meet these requirements?
- A
Enable CMEK for the Cloud SQL instance and specify a valid key from Cloud Key Management Service (KMS).
- B
Install and configure the Cloud SQL Auth Proxy to handle authentication and enforce SSL connections between the application and Cloud SQL.
- C
Generate a self-signed SSL certificate on the Compute Engine VM and configure it in the Cloud SQL instance.
- D
Restrict access to the Cloud SQL instance by configuring the authorized networks in the instance settings.
- E
Enable automatic IP assignment for the Compute Engine VM to simplify the connection to Cloud SQL.
Show answer and explanation
Correct answers: A, B, D
Explanation
To securely connect to a Cloud SQL instance while meeting encryption requirements, you must enable CMEK for customer-managed encryption, use the Cloud SQL Auth Proxy to ensure encrypted and IAM-based secure connections, and restrict access to the instance using authorized networks. Self-signed certificates are not necessary when using the Auth Proxy, and automatic IP assignment does not enhance security.
- A. Correct.
Correct: Enabling CMEK ensures the Cloud SQL instance uses a customer-managed encryption key from Cloud KMS, meeting the encryption requirement.
- B. Correct.
Correct: The Cloud SQL Auth Proxy provides a secure and encrypted connection to the database, and it handles IAM-based authentication, ensuring only authorized applications can connect.
- C. Incorrect.
Incorrect: While SSL certificates can provide encryption, self-signed certificates are not recommended for production environments and are not required when using the Cloud SQL Auth Proxy.
- D. Correct.
Correct: Restricting access to the Cloud SQL instance by specifying authorized networks enhances security by limiting connections to trusted sources.
- E. Incorrect.
Incorrect: Automatic IP assignment is not a recommended practice for securing communication with a Cloud SQL instance as it can introduce variability and is unrelated to encryption or security.