A cloud infrastructure engineer is tasked with deploying a new managed Cloud SQL database instance within a custom Virtual Private Cloud (VPC) named `internal-vpc`. Organizational security policy dictates that the database must not be assigned a public IP address and must only be reachable internally via private IP addresses from workloads inside `internal-vpc`. The network team has not yet configured Private Service Access for `internal-vpc`.
Which TWO steps must the cloud engineer perform to provision this database securely? (Select TWO.)
- Allocate an IP address range in `internal-vpc` and create a private connection between `internal-vpc` and the Google Service Networking service producer network.Answer
- Execute `gcloud sql instances create` specifying the `--network=internal-vpc` and `--no-assign-ip` flags.Answer
- CProvision the Cloud SQL instance with a public IP address and set `--authorized-networks=10.0.0.0/8` to restrict access to internal VPC subnets.
- DEnforce an Organization Policy constraint using `gcloud resource-manager org-policies set-policy` to map public database requests directly to internal subnets.
Answer
To deploy a Cloud SQL instance with exclusive Private IP connectivity in a custom VPC, the engineer must first allocate an IP address range and set up a private service access connection to Google Service Networking within the VPC, and then deploy the instance specifying `--network=internal-vpc` alongside `--no-assign-ip`.
Deploying Cloud SQL with Private IP requires establishing a Private Service Access connection in the target VPC network (allocating an IP range and peering with service networking). When running `gcloud sql instances create`, specifying `--network` links the instance to that peered network, and `--no-assign-ip` ensures no public IP is attached to the database.
Step-by-Step Solution
Key Concept
Private Service Access and Private IP provisioning for Google Cloud SQL instances
Estimated Time:2m 0s