An enterprise is designing a real-time data ingestion pipeline that transfers highly sensitive customer financial records from compute workloads in a private Virtual Private Cloud (VPC) to a managed Cloud SQL database instance. The security compliance policy mandates two strict requirements: All database connections in transit must strictly enforce TLS encryption, completely rejecting unencrypted client traffic. Data access must be restricted to internal network flows, and database resources must be protected against data exfiltration risks to unauthorized services outside the designated environment. Which combination of architecture and security configurations should the data engineer implement to satisfy these requirements?

Configure the Cloud SQL instance with `ssl_mode` set to `ENCRYPTED_ONLY`, connect compute workloads over Private Services Access, and place the project inside a VPC Service Controls service perimeter.: ### What the solution is This solution combines database-level transport security enforcement with network isolation and context-aware perimeter boundaries. By configuring the **Cloud SQL** instance with `ssl_mode` set to `ENCRYPTED_ONLY`, utilizing **Private Services Access (PSA)** for internal routing, and establishing a **VPC Service Controls (VPC SC)** service perimeter, data movement is protected at the transport, network, and organizational layers. ### How it meets the requirements - **Enforcing TLS Encryption**: Setting the database instance SSL mode to `ENCRYPTED_ONLY` guarantees that all incoming connections must use SSL/TLS encryption. Any connection attempt over cleartext or unencrypted TCP is rejected at the database listener level. - **Restricting to Private Data Flows**: Utilizing Private Services Access ensures that database traffic remains entirely within Google Cloud's private network using private IP addresses without exposure to the public internet. - **Preventing Data Exfiltration**: Enclosing the database project within a **VPC Service Controls** perimeter creates a secure boundary that mitigates unauthorized copying or transferring of data from managed services to external, unapproved environments. ### Key advantages and capabilities - **Strict Transport Security**: Guarantees end-to-end cryptographic protection for all data in transit across database sessions. - **Defense-in-Depth**: Integrates perimeter boundaries (VPC SC), network isolation (Private IP), and cryptographic enforcement (`ENCRYPTED_ONLY`). - **Zero Public Exposure**: Eliminates internet-facing endpoints for critical transactional database instances. - **Native Governance**: Standardizes data egress policies through centralized Google Cloud security perimeters. ### Why this is optimal This approach directly satisfies all regulatory mandates without relying on client-side discretion or exposing services to public endpoints. It ensures that traffic cannot traverse unencrypted channels, cannot be routed over the public internet, and cannot be exfiltrated outside the managed perimeter boundary.

Enforce Cloudsql Tls Vpc Service Controls | professional-cloud-data-engineer

Enforce Cloudsql Tls Vpc Service Controls

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise is designing a real-time data ingestion pipeline that transfers highly sensitive customer financial records from compute workloads in a private Virtual Private Cloud (VPC) to a managed Cloud SQL database instance. The security compliance policy mandates two strict requirements:

All database connections in transit must strictly enforce TLS encryption, completely rejecting unencrypted client traffic.
Data access must be restricted to internal network flows, and database resources must be protected against data exfiltration risks to unauthorized services outside the designated environment.

Which combination of architecture and security configurations should the data engineer implement to satisfy these requirements?

Enable public IP on the Cloud SQL instance with authorized networks limited to compute instance IPs, and store the database user credentials in Secret Manager.

Configure Cloud SQL with ssl_mode set to ALLOW_UNENCRYPTED_AND_ENCRYPTED, enforce egress firewall rules on compute subnets, and configure Cloud KMS customer-managed encryption keys (CMEK).

Configure the Cloud SQL instance with ssl_mode set to ENCRYPTED_ONLY, connect compute workloads over Private Services Access, and place the project inside a VPC Service Controls service perimeter.

Deploy Cloud NAT in the VPC network, configure SSL/TLS inspection on a Cloud Armor security policy, and deploy Shielded VM instances for data ingestion.

Professional Cloud Data Engineer

Enforce Cloudsql Tls Vpc Service Controls

Related questions