Exam Professional Cloud Database Engineer topic 1 question 110 discussion

Actual exam question from Google's Professional Cloud Database Engineer

Question #: 110
Topic #: 1

[All Professional Cloud Database Engineer Questions]

Your organization works with sensitive data that requires you to manage your own encryption keys. You are working on a project that stores that data in a Cloud SQL database. You need to ensure that stored data is encrypted with your keys. What should you do?

A. Export data periodically to a Cloud Storage bucket protected by Customer-Supplied Encryption Keys.
B. Use Cloud SQL Auth proxy.
C. Connect to Cloud SQL using a connection that has SSL encryption.
D. Use customer-managed encryption keys with Cloud SQL.

Show Suggested Answer

Suggested Answer: D 🗳️

by pk349 at Dec. 24, 2022, 10:31 p.m.

Comments

Submit Cancel

Pime13

5 months, 3 weeks ago

Selected Answer: D

https://cloud.google.com/sql/docs/mysql/configure-cmek https://cloud.google.com/sql/docs/postgres/configure-cmek https://cloud.google.com/sql/docs/sqlserver/configure-cmek https://cloud.google.com/sql/docs/sqlserver/configure-cmek#workflow_for_creating_a_instance_with_cmek

upvoted 1 times

...

dynamic_dba

1 year, 7 months ago

D. By stored data, we assume it means stored in the database so there’s no point in exporting it to encrypt it. A is wrong. Cloud SQL Auth Proxy is about secure connections to Cloud SQL, not encrypted data. B is wrong and so is C for the same reason. That leaves D. Just use CMEK when you create the instance.

upvoted 3 times

...

chelbsik

1 year, 10 months ago

Selected Answer: D

Standard CMEK quiestion, D

upvoted 3 times

...

pk349

1 year, 10 months ago

D: Use customer-managed encryption keys *** with Cloud SQL. How do I encrypt a SQL database? Enable Transparent Data Encryption (TDE) Create a master key. Create or obtain a certificate protected by the master key. Create a database encryption key and protect it by using the certificate. Set the database to use encryption.