Google Professional Cloud Database Engineer Question 61
Select 3Google Cloud PlatformYour organization uses Cloud SQL to host a MySQL database for a business-critical application. To meet compliance requirements, you need to ensure that all administrative access to the database, as well as any changes made to its configuration or data, are logged. Which steps should you take to configure appropriate auditing policies for Cloud SQL?
- A
Enable Cloud Audit Logs for administrative activity.
- B
Enable the Data Access logs in Cloud Audit Logs.
- C
Configure the MySQL
general_logandaudit_logtables to capture administrative access. - D
Ensure that the Cloud SQL instance has the 'Enable database auditing' option turned on.
- E
Grant the appropriate roles (e.g., roles/logging.viewer) to access and review logs.
Show answer and explanation
Correct answers: A, B, E
Explanation
To meet compliance requirements for auditing in Cloud SQL, you must enable Cloud Audit Logs for both administrative activity and data access. These logs capture all relevant actions, including configuration changes and access to data. Additionally, you must ensure that appropriate IAM roles are granted to review and analyze these logs. MySQL's internal logging mechanisms cannot be configured in managed Cloud SQL instances, and there is no specific 'Enable database auditing' option within Cloud SQL.
- A. Correct.
Correct: Cloud Audit Logs must be enabled for administrative activity to capture actions such as instance creation, deletion, or configuration changes.
- B. Correct.
Correct: Data Access logs are required to log access to the database and changes made to its data, which is crucial for compliance.
- C. Incorrect.
Incorrect: While MySQL has its own logging mechanisms, managed Cloud SQL does not allow direct configuration of MySQL's internal logging features like
general_logoraudit_log. Logging must be achieved through Cloud Audit Logs. - D. Incorrect.
Incorrect: Cloud SQL does not have a specific 'Enable database auditing' option. Auditing is achieved through Cloud Audit Logs and IAM permissions.
- E. Correct.
Correct: To review and analyze logs, you must grant appropriate IAM roles, such as roles/logging.viewer, to the relevant users or teams.