Google Associate Cloud EngineerDeploying and implementing a cloud solutionHard
A financial institution needs to deploy a highly secure and compliant application on Google Cloud. The application will store sensitive customer data, and access to this data must be restricted to specific internal IP addresses within their VPC network. External internet access to the application or its database is strictly forbidden. Which networking configuration is most appropriate for the application's database?
- ACloud Firestore in Datastore mode with default security rules
- BCloud SQL with Public IP and authorized networks
- CCloud Spanner with Public IP and firewall rules
- DCloud SQL with Private IP and VPC Service Controls
Show answer & explanationAnswer & explanation
Correct answer: D. Cloud SQL with Private IP and VPC Service Controls
Cloud SQL Private IP ensures the database is only accessible from within the VPC. VPC Service Controls create a security perimeter around resources, preventing data exfiltration and enforcing strict access policies, crucial for highly sensitive data and compliance.
Why the other options are wrong
- A. Cloud Firestore in Datastore mode is a good database, but default security rules alone might not meet the 'strictly forbidden external internet access' and 'highly secure and compliant' requirements as comprehensively as VPC Service Controls.
- B. Public IP, even with authorized networks, exposes the database to the internet, which is 'strictly forbidden'.
- C. Public IP, even with firewall rules, violates the 'strictly forbidden' external access requirement.
VPC Service Controls
A Google Cloud feature that allows you to create security perimeters around sensitive data and resources to mitigate data exfiltration risks.
- Restricts access to Google Cloud services from outside the perimeter.
- Prevents unauthorized data movement between projects and perimeters.
- Essential for high compliance and data security requirements.
Memory trick: Private IP and VPC Service Controls 'privately control' your data perimeter.