Examkin

Question

Difficulty: HardDeploying and Configuring Managed Database Instances

A DevOps team is deploying a production Cloud SQL for PostgreSQL instance named `app-postgres-db` using the Google Cloud CLI. The deployment policies mandate three strict requirements: the instance must communicate exclusively over Private IP within the existing Virtual Private Cloud (VPC) network `internal-vpc`, public IP address allocation must be explicitly disabled, and all incoming client connections must enforce SSL/TLS encryption. Additionally, the instance must automatically increase storage space when available capacity drops below the safety threshold. Which `gcloud` command should the engineer run to provision the database instance according to these requirements?

  1. gcloud sql instances create app-postgres-db --database-version=POSTGRES_15 --tier=db-custom-2-7680 --network=internal-vpc --no-assign-ip --require-ssl --enable-autoresizeAnswer
  2. B
    gcloud sql instances create app-postgres-db --database-version=POSTGRES_15 --tier=db-custom-2-7680 --network=internal-vpc --require-ssl --enable-autoresize
  3. C
    gcloud sql instances create app-postgres-db --database-version=POSTGRES_15 --tier=db-custom-2-7680 --network=internal-vpc --authorized-networks=10.0.0.0/16 --require-ssl --enable-autoresize
  4. D
    gcloud sql instances create app-postgres-db --database-version=POSTGRES_15 --tier=db-custom-2-7680 --network=internal-vpc --disable-public-ip --ssl=required --enable-autoresize

Answer

The command starting with 'gcloud sql instances create app-postgres-db' that specifies '--no-assign-ip', '--network=internal-vpc', '--require-ssl', and '--enable-autoresize' correctly provisions the instance according to all security and operational requirements.
The option including '--no-assign-ip', '--network=internal-vpc', '--require-ssl', and '--enable-autoresize' fulfills all compliance criteria. Specifying '--network' attaches the instance to the private network, while '--no-assign-ip' ensures no public IPv4 address is assigned. Furthermore, '--require-ssl' forces encrypted incoming client connections and '--enable-autoresize' automatically expands storage capacity as data grows.

Step-by-Step Solution

1
Identify the private IP connectivity requirement
Connecting to a VPC network requires the '--network' flag pointing to the designated VPC (internal-vpc).
Cloud SQL requires Private Service Access configuration in the VPC to instantiate private IP interfaces.
2
Identify the security requirement to disable public IP
By default, Cloud SQL assigns a public IP address even when attached to a VPC network unless '--no-assign-ip' is specified.
The '--no-assign-ip' flag suppresses the creation of an external IPv4 address on the Cloud SQL instance.
3
Verify SSL enforcement and storage scaling flags
Enforcing client SSL/TLS requires '--require-ssl', and automatic storage scaling requires '--enable-autoresize'.
These flags enforce protocol encryption and operational resilience against disk full errors.

Key Concept

Cloud SQL CLI Provisioning with Private IP, SSL Enforcement, and Auto-Resizing
Rate this question

Topics

Deploying and Configuring Managed Database Instances