Examkin

Question

Difficulty: HardProvisioning Storage and Database Systems

A cloud architect is establishing a secure provisioning workflow to deploy a multi-cluster Cloud Bigtable database for processing real-time trade data. The database must use Customer-Managed Encryption Keys (CMEK) and be accessible only via private network endpoints. In what order should the architect execute these steps to ensure all security and resource dependencies are satisfied?

  1. 1Create the Cloud KMS key ring and CryptoKey, and grant the Cloud Bigtable Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter role.
  2. 2Configure the VPC network with Private Google Access enabled and allocate an IP range for Private Services Access.
  3. 3Provision the Cloud Bigtable instance and clusters referencing the CMEK key and target VPC network.
  4. 4Create the Bigtable tables and define column families with garbage collection policies.
  5. 5Grant the application service account the Bigtable User role bound specifically to the created table resources.

Answer

The correct execution sequence is: First, create the Cloud KMS CryptoKey and grant the Cloud Bigtable Service Agent the CryptoKey Encrypter/Decrypter IAM role. Second, configure the VPC network with Private Google Access and Private Services Access IP allocation. Third, provision the Cloud Bigtable instance and clusters referencing the CMEK key. Fourth, create the Bigtable tables and configure column families. Fifth, grant the application service account the Bigtable User IAM role on the target table resources.
Provisioning GCP database infrastructure requires strict adherence to cryptographic and network dependency chains. First, the Cloud KMS key must exist and explicit encrypter/decrypter rights must be granted to the GCP service account for Bigtable. Second, the VPC networking layer and Private Services Access IP allocation must be ready. Third, the Bigtable instance is deployed using the CMEK key and network bindings. Fourth, once the instance is active, table structures and column families are created. Finally, identity permissions (such as Bigtable User) are applied to the application service account for the specific table resources.

Step-by-Step Solution

1
Provision Cloud KMS Key and bind Service Agent IAM role
Cloud Bigtable Service Agent (service-[PROJECT_NUM]@gcp-sa-bigtable.iam.gserviceaccount.com) has cryptographic permissions to wrap/unwrap data keys.
Google Cloud service APIs validate CMEK key permissions during instance instantiation; missing IAM bindings cause immediate deployment failure.
2
Configure VPC Networking and Private Services Access
VPC network contains allocated IP ranges and peered private connection endpoints.
Private network paths and IP ranges must be established prior to creating instance clusters bound to private VPC subnets.
3
Deploy Cloud Bigtable Instance and Regional Clusters
Active Cloud Bigtable instance with storage clusters encrypted using the specified CMEK key.
The parent managed instance resource must be fully initialized before child schema objects can be instantiated.
4
Instantiate Table Schema and Column Families
Tables and column family definitions with garbage collection rules exist inside the instance.
Schema definitions exist within the logical scope of an initialized Bigtable instance.
5
Bind Application Identity IAM Access
Application service account is authorized to perform data-plane reads and writes on specific tables.
Fine-grained IAM policy bindings at the table level require target table resource paths to exist in GCP IAM.

Key Concept

Dependency-Aware Provisioning Workflow for Encrypted GCP Storage
Rate this question

Topics

Provisioning Storage and Database Systems

More questions from this topic