1.3 Determine How Applications Will Connect to the Database PROFESSIONAL-CLOUD-DATABASE-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the purpose of Private Service Access when connecting to a managed database like Cloud SQL?

   • AIt allows the database to be accessed from the public internet with a static IP.
   • BIt establishes a VPN tunnel between on-premises and Google Cloud.
   • CIt allocates an internal IP address from your VPC network to the managed service.
   • DIt encrypts data in transit using TLS.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company is required to retain audit logs of all database access for at least one year and to be alerted when a specific user accesses sensitive data. They use Cloud SQL for PostgreSQL. What should they configure?

   • AUse Cloud Audit Logs only and set the retention period to 365 days in the Cloud Logging bucket.
   • BEnable the pgAudit extension and export logs to BigQuery for analysis.
   • CEnable Cloud Audit Logs for Cloud SQL and set up a log sink to Cloud Storage with a retention policy of 365 days. Create a log-based metric and alert for the specific user.
   • DEnable database flag log_statement=all and rely on the database logs stored in Cloud Logging.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company has a Cloud SQL for PostgreSQL instance with private IP. They want to allow only a specific Compute Engine VM to connect to the database. The VM is in the same VPC as the Cloud SQL instance. What should you do?

   • ACreate a firewall rule that allows ingress to the Cloud SQL instance's private IP from the VM's internal IP address.
   • BConfigure the Cloud SQL instance to allow all traffic from the VPC.
   • CAdd the VM's external IP address to the authorized networks list.
   • DCreate a VPC peering connection between the VM's VPC and the Cloud SQL instance's VPC.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security auditor is reviewing the audit policy for a Cloud SQL for MySQL instance. The policy currently enables Cloud Audit Logs for Data Access, but the auditor notes that logs are only retained for 30 days. The compliance requirement is to retain logs for 7 years. What should the team do to meet the requirement?

   • ACreate a log sink that exports Cloud Audit Logs to a Cloud Storage bucket with a retention policy of 7 years.
   • BIncrease the retention period of the Cloud Logging bucket to 7 years.
   • CEnable the database flag log_output=file and store the logs in the instance's disk.
   • DSet up a Cloud Scheduler job to copy logs from Cloud Logging to Cloud Storage every day.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the default state of encryption at rest for managed database services like Cloud SQL?

   • AEncryption is enabled by default using Google-managed keys.
   • BEncryption is only available with CMEK.
   • CEncryption is not supported for managed databases.
   • DEncryption is optional and must be enabled by the user.
   Reveal Solution Discussion Select an answer first