Examkin

Question

Difficulty: MediumSelecting and Designing Storage and Database Resources

A healthcare provider is designing the backend database architecture for a patient scheduling system hosted in a single Google Cloud region. The application requires a fully managed relational database supporting standard SQL queries and ACID transactions, with automatic failover across zones to ensure high availability. The compliance team mandates that encryption keys for data at rest must be stored and rotated in Google Cloud KMS without requiring the operations team to manage raw key material directly. Which database architecture should you recommend to meet these technical and compliance requirements with minimal operational cost?

  1. Provision a Cloud SQL database instance in High Availability (HA) configuration encrypted with Customer-Managed Encryption Keys (CMEK) stored in Cloud KMS.Answer
  2. B
    Provision a multi-region Cloud Spanner instance encrypted with Customer-Managed Encryption Keys (CMEK) stored in Cloud KMS.
  3. C
    Provision a Cloud SQL database instance in High Availability (HA) configuration using Customer-Supplied Encryption Keys (CSEK) provided at instance creation.
  4. D
    Provision a single-zone Cloud SQL instance and configure continuous backup exports to Cloud Storage protected by standard IAM bucket permissions.

Answer

Provision a Cloud SQL database instance in High Availability (HA) configuration encrypted with Customer-Managed Encryption Keys (CMEK) stored in Cloud KMS.
The correct answer recommends Cloud SQL configured for High Availability (HA) paired with Customer-Managed Encryption Keys (CMEK) via Cloud KMS. Cloud SQL HA provisions primary and standby instances in separate zones within a single region, satisfying the requirement for automatic cross-zone failover and standard relational SQL ACID transactions. Utilizing CMEK fulfills compliance and key management requirements by storing keys in Cloud KMS without forcing the operations team to handle raw key material.

Step-by-Step Solution

1
Analyze database workload requirements
The application requires standard relational SQL capabilities, ACID compliance, single-region deployment, and zonal failover (High Availability). Cloud SQL HA satisfies these requirements cost-effectively.
Cloud SQL provides fully managed relational capabilities with regional HA (primary and standby instances across zones) without the premium multi-region global scale pricing of Cloud Spanner.
2
Evaluate key management and security governance constraints
The policy requires Cloud KMS key integration and automatic key rotation without managing raw key material.
Customer-Managed Encryption Keys (CMEK) natively integrate with Cloud KMS to allow automated key rotation and centralized audit logging without the burden of storing or supplying raw key strings manually (CSEK).
3
Synthesize optimal database and storage service configuration
Combining Cloud SQL HA with CMEK satisfies all availability, relational integrity, security, and cost constraints.
This setup provides the required zonal failover and compliance standards while avoiding over-provisioning.

Key Concept

Selecting Cloud SQL HA with CMEK for Regional Relational Workloads
Rate this question

Topics

Selecting and Designing Storage and Database Resources