Google Professional Cloud Database Engineer Question 96
Select 4Google Cloud PlatformYou are designing a secure database solution on Google Cloud for a financial services application that stores sensitive customer data. The database will be deployed in Cloud SQL, and the application is hosted on Google Kubernetes Engine (GKE). Which of the following are appropriate considerations to ensure secure connectivity and access management between the application and the database?
- A
Enable private IP for Cloud SQL to ensure the database is only accessible within the VPC.
- B
Use a Cloud SQL database user with a hardcoded password stored in the application code for authentication.
- C
Leverage IAM database authentication to provide secure, role-based access to the database.
- D
Set up a VPC Service Controls perimeter to restrict data movement between the database and external networks.
- E
Use SSL/TLS to encrypt data in transit between the application and the database.
Show answer and explanation
Correct answers: A, C, D, E
Explanation
Secure database connectivity and access management are critical for protecting sensitive data. Enabling private IP restricts access to the database within the VPC, while IAM database authentication and VPC Service Controls provide strong access controls. Encrypting data in transit with SSL/TLS ensures communication security. Hardcoding passwords in the application code is a poor security practice and should be avoided.
- A. Correct.
Enabling private IP for Cloud SQL restricts database access to resources within the Virtual Private Cloud (VPC), enhancing security by preventing public network exposure.
- B. Incorrect.
Using a hardcoded password in the application code is insecure and not recommended because it increases the risk of credential leakage.
- C. Correct.
IAM database authentication integrates with Google Cloud IAM to provide secure, role-based access, reducing the complexity of managing database credentials.
- D. Correct.
VPC Service Controls help enforce fine-grained restrictions on data movement, adding an additional layer of security around sensitive databases.
- E. Correct.
SSL/TLS encryption ensures that data transmitted between the application and the database is secure from interception.