On‑premises MySQL has no public IP. You must ingest data into BigQuery securely without using the public internet. Which approach do you choose?

The correct option leverages Datastream for CDC (Change Data Capture) from MySQL to BigQuery. Cloud Interconnect provides a dedicated, private connection between your on-premises network and Google Cloud, ensuring data never traverses the public internet. Selecting Private connectivity within Datastream and allocating a VPC IP range routes the traffic securely over this private connection. Server-only encryption ensures data is encrypted in transit without requiring client-side certificates, which is sufficient for a private link. The first incorrect option, using an ODBC driver with a NAT gateway, still relies on the public internet for BigQuery access, which violates the security requirement. The third incorrect option, a Forward-SSH tunnel, is less scalable and secure than Cloud Interconnect for continuous data ingestion and explicitly states "encryption type to None," which is a security risk. The fourth incorrect option, IP Allowlisting, also relies on the public internet and opening firewall ports to public IP addresses, which is not secure for this scenario.