You are planning to migrate a 10 TB relational database from an on-premises environment to Cloud SQL for PostgreSQL. The database contains sensitive customer information. You want to follow Google-recommended practices to keep data secure during the migration. What should you do? (Choose two.)

A. Configure Cloud SQL for automatic patching, and enable binary logging. B. Establish a Private Service Connect connection between your on-premises environment and the Cloud SQL instance. C. Use an external IP address for the Cloud SQL instance, and configure firewall rules. D. Set up Identity and Access Management (IAM) roles to restrict access with Cloud SQL with an internal IP address. E. Leverage Storage Transfer Service with client-side encryption.