Examkin

Question

Difficulty: MediumProvisioning Storage and Database Systems

An analytics platform team is building an automated Infrastructure as Code (IaC) pipeline to provision a high-throughput time-series database for video streaming metrics using Cloud Bigtable. Company security guidelines dictate that all infrastructure state data must support concurrent access locking with point-in-time recovery against accidental overwrites. Furthermore, data at rest must be encrypted using keys managed centrally within Google Cloud without requiring raw secret keys to be managed manually by the operations team. Which combination of storage and configuration choices satisfies these operational and security requirements?

  1. Configure a Terraform Cloud Storage (GCS) backend with Object Versioning enabled for state management, and provision the Cloud Bigtable instance using Customer-Managed Encryption Keys (CMEK) stored in Cloud KMS.Answer
  2. B
    Store the Terraform state file in an unversioned local directory shared via network file share, and provision Cloud Bigtable with default Google-managed keys.
  3. C
    Provision a Cloud Spanner multi-region instance instead of Cloud Bigtable to handle time-series metrics ingestion, and commit the state file directly to the source control repository.
  4. D
    Configure Cloud Bigtable using Customer-Supplied Encryption Keys (CSEK) passed directly within Terraform variable files, and store the state file in a standard bucket without object versioning.

Answer

Configure a Terraform Cloud Storage (GCS) backend with Object Versioning enabled for state management, and provision the Cloud Bigtable instance using Customer-Managed Encryption Keys (CMEK) stored in Cloud KMS.
Configuring a Terraform GCS backend with Object Versioning enabled ensures native state locking during concurrent pipeline runs and allows recovery if state file corruption occurs. Utilizing Cloud Bigtable encrypted with Customer-Managed Encryption Keys (CMEK) via Cloud KMS ensures central compliance auditing and encryption management without handling raw key bytes.

Step-by-Step Solution

1
Evaluate the Infrastructure as Code (IaC) state storage requirements.
Identified that a Cloud Storage (GCS) remote backend with Object Versioning enabled satisfies concurrent state locking and historical recovery needs.
GCS backends automatically utilize GCP object locks to prevent concurrent mutations and versioning ensures state history can be restored.
2
Evaluate the database encryption requirements for data at rest.
Identified that Customer-Managed Encryption Keys (CMEK) integrated with Cloud KMS meet key management policies without raw key exposure.
CMEK allows central governance over key rotation and IAM access control within Cloud KMS.

Key Concept

Provisioning Cloud Bigtable with CMEK and securing IaC Terraform state using versioned Cloud Storage backends.
Rate this question

Topics

Provisioning Storage and Database Systems

More questions from this topic