Exam Professional Cloud Database Engineer topic 1 question 58 discussion

C. To satisfy audit reporting you would need a way to record what was changed and when. The best answer is one which uses some kind of source code control system (SCCS). That rules out A and B. Any mention of anything manual in a cloud environment should look suspicious, which leave option C. As it happens, Liquibase is an SCCS and can be integrated with Spanner. https://cloud.google.com/spanner/docs/use-liquibase

https://cloud.google.com/spanner/docs/use-liquibase

Use Liquibase to roll out changes to higher environments.

The correct answer is => D. Manually capturing audit logs provides the level of granularity and control required for compliance auditing.

D. Auditors wants to see what changed. The only way to showcase that is to capture the audit logs, who changed what... Hence D

C, liquidbase for db source control

I assume production environment shall be a standalone project. Based on this, A: No. Replication can't be done cross projects. B: No. Backup / restore only get a whole set drop / load statements from audit logs. External auditors would focus on "what changes". C: Yes. Liguibase could export change.yaml to hand over the external auditors. D: No. No way to capture audit logs and ship to the target project. Spanner is a managed service. Reference: https://cloud.google.com/spanner/docs/backup/gcloud https://cloud.google.com/spanner/docs/use-liquibase

https://cloud.google.com/spanner/docs/audit-logging#audited_operations

C, liquidbase for db source control

B: Use backup and restore ***** to roll out changes to higher environments. [1] Even though restoring a database requires authorization on two resources (the backup ***** and restored database, which might reside in different instances), the RestoreDatabase event is logged only once as a single entry in the instance of the restored database. Within this entry, there will be two authorizationInfo entries: one for the database, checking the spanner.databases.create permission, and one for the backup, checking the spanner.backups.restoreDatabase permission.