Advanced
Prepare and test your skills
Advanced
Prepare and test your skills
Enforcing TLS and Private Access for Cloud SQL
Free sample question, answered and explained below. The Professional Data Engineer practice bank has 1,353 more like it. Try 10 free: instant score, no account.
An enterprise is designing a real-time data ingestion pipeline that transfers highly sensitive customer financial records from compute workloads in a private Virtual Private Cloud (VPC) to a managed Cloud SQL database instance. The security compliance policy mandates two strict requirements:
- All database connections in transit must strictly enforce TLS encryption, completely rejecting unencrypted client traffic.
- Data access must be restricted to internal network flows, and database resources must be protected against data exfiltration risks to unauthorized services outside the designated environment.
Which combination of architecture and security configurations should the data engineer implement to satisfy these requirements?
Explanations
Enable public IP on the Cloud SQL instance with authorized networks limited to compute instance IPs, and store the database user credentials in Secret Manager.
Enable public IP on the Cloud SQL instance with authorized networks limited to compute instance IPs, and store the database user credentials in Secret Manager.
What the option does
This configuration assigns an external public IP address to the Cloud SQL instance, restricts incoming IP connections using database Authorized Networks ACLs, and manages database connection strings and passwords using Secret Manager.
Why it doesn't meet the requirement
- Fails TLS Enforcement: Configuring authorized networks and Secret Manager does not enforce server-side SSL/TLS connection requirements; clients can still connect over cleartext unless the instance's SSL mode is explicitly configured.
- Fails Private Network Flow: Enabling public IP exposes the database endpoint externally on the internet, even if restricted by IP whitelisting, which violates the requirement for strictly private network flows.
- Fails Perimeter Controls: It lacks VPC Service Controls, leaving managed database APIs without perimeter protection against data exfiltration.
Key characteristics and limitations
- Authorized Networks provide network-level access control lists based on public IPv4 addresses.
- Secret Manager secures static application secrets and certificates but does not dictate communication protocols or TLS enforcement.
- Public database endpoints increase exposure to scanning and unauthorized network probing.
This answer would be correct if
The pipeline needed secure credential distribution and public internet ingress restricted to a known set of fixed static external IP addresses.
Additional context
Storing connection passwords and SSL certificates in Secret Manager is an operational best practice, but it must be paired with private IPs and strict database SSL enforcement to provide in-transit security.
Deploy Cloud NAT in the VPC network, configure SSL/TLS inspection on a Cloud Armor security policy, and deploy Shielded VM instances for data ingestion.
Deploy Cloud NAT in the VPC network, configure SSL/TLS inspection on a Cloud Armor security policy, and deploy Shielded VM instances for data ingestion.
What the option does
This option provisions Cloud NAT to provide outbound internet connectivity for private VMs, attempts to attach Cloud Armor security policies for traffic inspection, and enables Shielded VMs for compute workloads.
Why it doesn't meet the requirement
- Fails TLS Enforcement: Shielded VMs and Cloud NAT have no capability to configure or enforce TLS settings on managed Cloud SQL instances.
- Inapplicable Service Architecture: Cloud Armor protects HTTP(S) external load balancers and web applications against DDoS and web attacks; it does not protect internal Layer 4 database protocols or enforce TLS between internal compute nodes and Cloud SQL.
- Missing Perimeter Boundary: Cloud NAT facilitates outbound internet egress rather than establishing a private VPC Service Controls perimeter to prevent data exfiltration.
Key characteristics and limitations
- Cloud NAT provides source network address translation for egress-only internet connectivity.
- Cloud Armor functions at the HTTP/HTTPS load balancer edge, not on internal TCP database sockets.
- Shielded VMs provide boot integrity and rootkit protection for compute nodes.
This answer would be correct if
The primary goal was to inspect external inbound web application traffic against common web application vulnerabilities while providing outbound internet access for patching private virtual machines.
Additional context
Database-level encryption in transit must be enforced at the database service itself using TLS certificates and flags, rather than relying on perimeter web application firewalls.
Configure the Cloud SQL instance with ssl_mode set to ENCRYPTED_ONLY, connect compute workloads over Private Services Access, and place the project inside a VPC Service Controls service perimeter.
Configure the Cloud SQL instance with ssl_mode set to ENCRYPTED_ONLY, connect compute workloads over Private Services Access, and place the project inside a VPC Service Controls service perimeter.
What the solution is
This solution combines database-level transport security enforcement with network isolation and context-aware perimeter boundaries. By configuring the Cloud SQL instance with ssl_mode set to ENCRYPTED_ONLY, utilizing Private Services Access (PSA) for internal routing, and establishing a VPC Service Controls (VPC SC) service perimeter, data movement is protected at the transport, network, and organizational layers.
How it meets the requirements
- Enforcing TLS Encryption: Setting the database instance SSL mode to
ENCRYPTED_ONLYguarantees that all incoming connections must use SSL/TLS encryption. Any connection attempt over cleartext or unencrypted TCP is rejected at the database listener level. - Restricting to Private Data Flows: Utilizing Private Services Access ensures that database traffic remains entirely within Google Cloud's private network using private IP addresses without exposure to the public internet.
- Preventing Data Exfiltration: Enclosing the database project within a VPC Service Controls perimeter creates a secure boundary that mitigates unauthorized copying or transferring of data from managed services to external, unapproved environments.
Key advantages and capabilities
- Strict Transport Security: Guarantees end-to-end cryptographic protection for all data in transit across database sessions.
- Defense-in-Depth: Integrates perimeter boundaries (VPC SC), network isolation (Private IP), and cryptographic enforcement (
ENCRYPTED_ONLY). - Zero Public Exposure: Eliminates internet-facing endpoints for critical transactional database instances.
- Native Governance: Standardizes data egress policies through centralized Google Cloud security perimeters.
Why this is optimal
This approach directly satisfies all regulatory mandates without relying on client-side discretion or exposing services to public endpoints. It ensures that traffic cannot traverse unencrypted channels, cannot be routed over the public internet, and cannot be exfiltrated outside the managed perimeter boundary.
Configure Cloud SQL with ssl_mode set to ALLOW_UNENCRYPTED_AND_ENCRYPTED, enforce egress firewall rules on compute subnets, and configure Cloud KMS customer-managed encryption keys (CMEK).
Configure Cloud SQL with ssl_mode set to ALLOW_UNENCRYPTED_AND_ENCRYPTED, enforce egress firewall rules on compute subnets, and configure Cloud KMS customer-managed encryption keys (CMEK).
What the option does
This configuration relies on default dual-mode database connection settings, Compute Engine subnet egress firewall rules, and Customer-Managed Encryption Keys (CMEK) via Cloud KMS.
Why it doesn't meet the requirement
- Fails TLS Enforcement: Setting
ssl_modetoALLOW_UNENCRYPTED_AND_ENCRYPTEDallows non-SSL/non-TLS cleartext database connections whenever a client does not explicitly request encryption, directly violating the requirement to strictly reject unencrypted traffic. - Fails Exfiltration Prevention: While firewall rules restrict network destinations for VM instances, they do not establish security perimeters around Google-managed service APIs, leaving the system susceptible to API-level data exfiltration.
- Addresses the Wrong Domain: CMEK provides encryption at rest rather than encryption in transit.
Key characteristics and limitations
ALLOW_UNENCRYPTED_AND_ENCRYPTEDis the default Cloud SQL mode and allows unencrypted traffic.- Subnet firewall rules operate at the VPC Layer 3/4 network level, not at the managed service API boundary.
- CMEK secures stored blocks on persistent disks but does not secure active network connections in flight.
This answer would be correct if
The goal was to implement encryption at rest with customer-controlled cryptographic keys while accommodating legacy clients that lack TLS capabilities.
Additional context
Relying on client-side requests to enable TLS introduces misconfiguration risk. Enforcing ENCRYPTED_ONLY on the server ensures absolute compliance regardless of client configuration.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 1,353 practice questions across all 5 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
AdvancedProfessional Data Engineer
CSEK vs CMEK vs Cloud EKM
Data encryption
AdvancedProfessional Data Engineer
Cloud KMS Envelope Encryption
Data encryption
AdvancedProfessional Data Engineer
Cloud DLP Conditional Record Transformations
Security, data masking, Identity and Access Management (IAM), and Cloud Data Loss Prevention (Cloud DLP)
AdvancedProfessional Data Engineer
BigQuery Multi-Project Architecture
Mapping current and future business requirements to the architecture
AdvancedProfessional Data Engineer
Cloud Composer Deferrable Operators
Interactive or batch query jobs
FundamentalAssociate Data Practitioner
Avro vs Parquet Data Formats
Distinguish the format of the data (e.g., CSV, JSON, Apache Parquet, Apache Avro, structured database tables)
Last updated Validated