1.3 Determine How Applications Will Connect to the Database PROFESSIONAL-CLOUD-DATABASE-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is a key benefit of connection pooling for an application workload?

   • AIt reduces the latency of establishing new database connections.
   • BIt eliminates the need for database authentication.
   • CIt increases the storage capacity of the database.
   • DIt automatically encrypts all data in transit.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the primary benefit of using Customer-Managed Encryption Keys (CMEK) for a managed database service?

   • AIt reduces the cost of encryption at rest.
   • BIt automatically encrypts data in transit.
   • CIt allows you to control and manage the keys used to encrypt data at rest.
   • DIt eliminates the need for TLS/SSL.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   When using IAM-based authentication for Cloud SQL, what does the IAM user or service account represent?

   • AA database user that is created and managed within the database engine.
   • BA Google Cloud identity that is automatically mapped to a database user with the same name.
   • CA network-level identity used for firewall rules.
   • DA temporary credential that expires after a short time.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company is migrating a legacy application to Google Cloud. The application uses a single database user with a password to connect to Cloud SQL for MySQL. The security team wants to move to IAM-based authentication and require that all database access be audited. The application cannot be modified to use a different authentication method. What should the team do?

   • AKeep the database user with a password and enable Cloud Audit Logs for Cloud SQL to track access.
   • BUse the Cloud SQL Auth Proxy to handle authentication and rely on its logs.
   • CDisable password-based authentication and use only IAM-based authentication.
   • DCreate an IAM database user for the application and update the application's connection string to use it.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company has a hybrid cloud architecture with an on-premises data center connected to Google Cloud via a VPN. They run a Cloud SQL for PostgreSQL instance with private IP. The application servers on-premises need to connect to the database. The security team requires that traffic be encrypted in transit and that access be restricted to only the on-premises application servers. What should you do?

   • ACreate a VPC peering connection between the on-premises network and the VPC, and connect using the instance's private IP.
   • BConfigure the Cloud SQL instance to use private IP and ensure the VPN tunnel routes traffic to the VPC. Create a firewall rule allowing traffic from the on-premises application server IP range to the instance's private IP. Use SSL/TLS for connections.
   • CEnable public IP on the Cloud SQL instance and add the on-premises application server IPs to the authorized networks list. Use SSL/TLS for connections.
   • DUse the Cloud SQL Auth Proxy on the on-premises servers and connect to the instance's public IP.
   Reveal Solution Discussion Select an answer first