Google Professional Cloud Database Engineer Question 55
Select 4Google Cloud PlatformYou are tasked with securing a Cloud SQL database instance hosting sensitive customer data. The requirements are: 1) Encrypt data at rest using your own encryption keys, 2) Ensure only applications within your private network can connect to the database, and 3) Use SSL/TLS to secure connections between the application and the database. Which combination of methods should you implement to meet the requirements?
- A
Enable CMEK (Customer-Managed Encryption Keys) for the Cloud SQL instance.
- B
Use the Cloud SQL Auth Proxy for connecting applications to the database.
- C
Generate and configure SSL certificates for the Cloud SQL instance.
- D
Enable public IP on the Cloud SQL instance and configure IP whitelisting.
- E
Enable private IP for the Cloud SQL instance.
Show answer and explanation
Correct answers: A, B, C, E
Explanation
To secure the Cloud SQL instance as per the requirements, you must encrypt data at rest using CMEK, secure connections using SSL certificates and the Cloud SQL Auth Proxy, and restrict access to applications within the private network by enabling private IP. Avoid using public IP to minimize exposure to external threats.
- A. Correct.
Correct. Enabling CMEK allows you to encrypt data at rest with your own encryption keys, fulfilling the first requirement.
- B. Correct.
Correct. The Cloud SQL Auth Proxy ensures secure connections and simplifies IAM-based application authentication, contributing to the security of the database.
- C. Correct.
Correct. Using SSL certificates secures the connections between the application and the database, meeting the third requirement.
- D. Incorrect.
Incorrect. Enabling public IP, even with IP whitelisting, exposes your instance to the internet, which does not satisfy the requirement of restricting connections to your private network.
- E. Correct.
Correct. Enabling private IP ensures that only applications within your private network can access the database, fulfilling the second requirement.