Google Professional Cloud Network Engineer Question 46
Single answerGoogle Cloud PlatformYou are designing a network architecture for a company that needs to securely access a managed Cloud SQL instance from their on-premises environment. The solution must avoid exposing the Cloud SQL instance to the public internet and provide low-latency connectivity. Which of the following approaches should you include in your design?
- A
Use Private Service Connect to create a private endpoint for the Cloud SQL instance and route traffic through it.
- B
Use a public IP for the Cloud SQL instance and configure a firewall rule to restrict access to the on-premises IP range.
- C
Use Cloud VPN to establish a secure tunnel between on-premises and the VPC hosting the Cloud SQL instance.
- D
Use Private Services Access to allocate an internal IP range for the Cloud SQL instance and connect it to the on-premises environment.
Show answer and explanation
Correct answer: A
Explanation
Private Service Connect is the optimal solution for securely and privately connecting to managed services like Cloud SQL from on-premises environments. It creates a private endpoint that ensures low-latency connectivity and avoids exposing the service to the public internet. Other options either fail to meet the security requirements or do not directly address the need for private access to the managed service.
- A. Correct.
Correct: Private Service Connect allows you to create a private endpoint for Google-managed services like Cloud SQL, enabling private and secure connectivity without exposing the service to the public internet.
- B. Incorrect.
Incorrect: Using a public IP for the Cloud SQL instance would expose it to the public internet, which does not meet the requirement to avoid public exposure.
- C. Incorrect.
Incorrect: While Cloud VPN can securely connect on-premises to the VPC, it does not inherently provide private connectivity to managed services like Cloud SQL.
- D. Incorrect.
Incorrect: Private Services Access is used to allocate internal IP ranges for managed services in the VPC, but it does not handle the routing or private endpoint creation required for on-premises connectivity.