Google Professional Cloud Database Engineer Question 95
Single answerGoogle Cloud PlatformYou are designing a cloud-based application that connects to a Cloud SQL instance. The application runs on Google Kubernetes Engine (GKE), and you want to ensure secure connectivity while minimizing the need for managing credentials. Which connectivity and access management solution should you choose?
- A
Use a private IP for the Cloud SQL instance and configure firewall rules to allow GKE nodes to connect.
- B
Use the Cloud SQL Auth Proxy and configure it to authenticate with a service account.
- C
Enable public IP for the Cloud SQL instance and use username and password authentication.
- D
Use mutual TLS (mTLS) to establish a direct connection between GKE and the Cloud SQL instance.
Show answer and explanation
Correct answer: B
Explanation
The Cloud SQL Auth Proxy is the recommended solution for secure connectivity to a Cloud SQL instance from GKE. It handles authentication using a service account, avoiding the need to manage database credentials manually. This simplifies access management while maintaining high security levels.
- A. Incorrect.
While using a private IP and configuring firewall rules ensures secure connectivity, it doesn't address access management, such as managing credentials for your application.
- B. Correct.
Using the Cloud SQL Auth Proxy allows secure connectivity by authenticating with a service account, eliminating the need for username/password management and ensuring secure communication.
- C. Incorrect.
Enabling a public IP and using username/password authentication is less secure and involves credential management overhead, which is not recommended.
- D. Incorrect.
Mutual TLS (mTLS) can secure communication, but it's not a native feature for connecting GKE to Cloud SQL. Additional setup would be required, making it less practical in this scenario.