Google Professional Cloud Database Engineer Question 98
Select 3Google Cloud PlatformYou are designing a Google Cloud SQL database for a web application that requires secure access from both on-premises servers and a serverless application hosted in Cloud Run. Which of the following considerations should you prioritize to ensure secure connectivity and proper access management?
- A
Configure a private IP for the Cloud SQL instance and set up a VPN or Interconnect to connect on-premises servers.
- B
Implement Cloud SQL Auth Proxy for secure connectivity from the serverless application.
- C
Assign the Cloud SQL Admin IAM role to the service account used by the Cloud Run application.
- D
Enable public IP for the Cloud SQL instance and restrict access using IP allowlisting.
- E
Use a service account with minimal necessary permissions for the Cloud Run application to access the database.
Show answer and explanation
Correct answers: A, B, E
Explanation
For secure connectivity and access management, you should prioritize using private IPs for on-premises connectivity and secure proxies such as the Cloud SQL Auth Proxy for serverless applications. Additionally, adhering to the principle of least privilege by using minimally scoped service accounts ensures that access is both secure and well-managed. Public IPs should be avoided where possible to minimize security risks.
- A. Correct.
Correct: Configuring a private IP and setting up a VPN or Interconnect allows secure and private connectivity between on-premises servers and the Cloud SQL instance.
- B. Correct.
Correct: The Cloud SQL Auth Proxy is a secure way to connect serverless applications, like those in Cloud Run, to a Cloud SQL instance without exposing credentials.
- C. Incorrect.
Incorrect: Assigning the Cloud SQL Admin IAM role grants excessive privileges and does not follow the principle of least privilege. A more restrictive role should be used.
- D. Incorrect.
Incorrect: Enabling a public IP increases the attack surface, even with IP allowlisting, and is not recommended when private IP and secure proxies can be used.
- E. Correct.
Correct: Using a service account with minimal permissions adheres to the principle of least privilege and ensures secure access to the database.