Examkin

Question

Difficulty: Very hardDeploying and Configuring Managed Database Instances

A cloud engineer is provisioning a high-availability Cloud SQL for MySQL instance named `prod-mysql-db` within a Virtual Private Cloud (VPC) network named `corporate-vpc`. Corporate security guidelines dictate that the database instance must not have a public IP address, must be accessible exclusively via private IP within the VPC, must provide regional high availability, and must encrypt data at rest using a Customer-Managed Encryption Key (CMEK). Which TWO tasks must be performed to successfully deploy this database configuration?

  1. Reserve an IP address range in `corporate-vpc` for private service access and establish a VPC peering connection using the Service Networking API.Answer
  2. Execute `gcloud sql instances create prod-mysql-db --network=corporate-vpc --no-assign-ip --availability-type=REGIONAL --kms-key-name=projects/MY_PROJECT/locations/LOCATION/keyRings/RING/cryptoKeys/KEY`.Answer
  3. C
    Execute `gcloud sql instances create prod-mysql-db --assign-ip --authorized-networks=0.0.0.0/0 --availability-type=ZONAL` to establish a secure multi-zone connection.
  4. D
    Assign the primitive `roles/owner` role to the default Compute Engine service account to grant Cloud SQL automatic authorization to decrypt the Customer-Managed Encryption Key.

Answer

The correct steps are reserving an internal IP address range in `corporate-vpc` to establish a Private Services Access connection, and running `gcloud sql instances create prod-mysql-db` with `--network=corporate-vpc`, `--no-assign-ip`, `--availability-type=REGIONAL`, and `--kms-key-name`.
To deploy a Cloud SQL instance with Private IP connectivity, you must first create a Private Services Access connection in the target VPC network using the Service Networking API. When creating the Cloud SQL instance via the gcloud CLI, setting `--no-assign-ip` prevents public IP allocation, `--network` binds the instance to the peered VPC, `--availability-type=REGIONAL` configures automatic failover across zones, and `--kms-key-name` specifies the Cloud KMS key for CMEK encryption.

Step-by-Step Solution

1
Allocate a private IP block and configure Private Services Access.
Establishes VPC peering between the customer VPC network and Google's internal service producer network where Cloud SQL instances reside.
Cloud SQL Private IP connections rely on private service access via the Service Networking API.
2
Ensure the Cloud SQL Service Account has KMS encrypter/decrypter access.
Allows Cloud SQL to use the specified KMS key for CMEK.
Without `roles/cloudkms.cryptoKeyEncrypterDecrypter` granted to the Cloud SQL service agent, instance creation with CMEK will fail.
3
Execute the `gcloud sql instances create` deployment command with required flags.
Creates a regionally available, private IP-only Cloud SQL instance encrypted with CMEK.
`--no-assign-ip` disables public IP, `--network` attaches it to the VPC, `--availability-type=REGIONAL` enables HA failover, and `--kms-key-name` specifies the CMEK key.

Key Concept

Cloud SQL Private IP, High Availability, and Customer-Managed Encryption Keys (CMEK) Configuration
Rate this question

Topics

Deploying and Configuring Managed Database Instances