You are planning to migrate a 10 TB relational database from an on-premises environment to Cloud SQL for PostgreSQL. The database contains sensitive customer information. You want to follow…

Question

Options

• AConfigure Cloud SQL for automatic patching, and enable binary logging.
• BEstablish a Private Service Connect connection between your on-premises environment and the
• CUse an external IP address for the Cloud SQL instance, and configure firewall rules.
• DSet up Identity and Access Management (IAM) roles to restrict access with Cloud SQL with an
• ELeverage Storage Transfer Service with client-side encryption.

Explanation

The correct answers are B and D. For a migration involving sensitive customer data, Google-recommended practices focus on private connectivity and least-privilege access. Option B (Private Service Connect between on-premises and Cloud SQL) ensures the 10 TB of sensitive data never traverses the public internet, providing a private, encrypted network path. Option D (IAM roles to restrict access with least privilege) enforces who can connect to or administer the Cloud SQL instance, a core Google security best practice. Option A (auto patching + binary logging) is about operations, not migration security. Option C (external IP + firewall rules) exposes the instance to the public internet, which is less secure. Option E (Storage Transfer Service) is for object/file storage migration, not relational database migration.

No community discussion yet for this question.