Google Professional Cloud Database Engineer Question 97
Select 3Google Cloud PlatformYour company is deploying a PostgreSQL database on Cloud SQL. The database will handle sensitive customer data, and you must ensure secure connectivity and access management. Which of the following actions should you take to meet this requirement?
- A
Enable private IP for the Cloud SQL instance to ensure internal network communication.
- B
Use a service account with the Cloud SQL Client role to allow secure access from applications.
- C
Allow access to the database by whitelisting all public IP addresses to simplify connectivity.
- D
Enable SSL/TLS encryption for all database connections to protect data in transit.
- E
Grant the Cloud SQL Admin role to all developers for easier troubleshooting.
Show answer and explanation
Correct answers: A, B, D
Explanation
To ensure secure connectivity and access management for a Cloud SQL instance handling sensitive data, you should use private IP to avoid exposing the database to the public internet, configure SSL/TLS encryption to protect data during transit, and use service accounts with minimal privileges to restrict access. Avoiding public IP access and excessive permissions prevents potential security vulnerabilities.
- A. Correct.
Enabling private IP ensures that the database communicates over a secure internal network, reducing exposure to the public internet. This is a critical best practice for handling sensitive data.
- B. Correct.
Using a service account with the least privilege, such as the Cloud SQL Client role, ensures that only authorized applications can connect to the database securely.
- C. Incorrect.
Whitelisting all public IP addresses exposes the database to potential unauthorized access, which is a security risk and should be avoided.
- D. Correct.
Enabling SSL/TLS encryption ensures that data is encrypted in transit, protecting it from interception or tampering during communication.
- E. Incorrect.
Granting the Cloud SQL Admin role to all developers violates the principle of least privilege and increases the risk of unintentional or malicious changes to the database configuration.