Examkin

Question

Difficulty: HardProvisioning Storage and Database Systems

An enterprise financial organization is deploying a globally distributed relational database using Cloud Spanner to process cross-border transactions. Security compliance mandates that all database storage must be encrypted using Customer-Managed Encryption Keys (CMEK) managed in a dedicated central security project, and the database schema must be initialized prior to attaching automated backup policies. In what sequential order should the cloud engineering team execute the provisioning and configuration workflow?

  1. 1Grant the Cloud Spanner Service Agent in the application project the Cloud KMS CryptoKey Encrypter/Decrypter IAM role on the designated KMS key in the security project.
  2. 2Provision the multi-region Cloud Spanner instance specifying the target instance configuration and compute capacity.
  3. 3Create the Cloud Spanner database within the instance, passing the Cloud KMS CryptoKey resource identifier during initialization.
  4. 4Execute Data Definition Language (DDL) statements against the database to create relational tables, secondary indexes, and database roles.
  5. 5Configure the automated Cloud Spanner database backup schedule and Point-in-Time Recovery (PITR) retention policy.

Answer

The correct operational sequence begins by granting the Cloud Spanner Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter IAM role on the central KMS key. Next, provision the multi-region Cloud Spanner instance. Follow this by creating the Cloud Spanner database while specifying the CMEK key URI. Then, execute DDL statements to populate tables and schema definitions. Finally, establish the automated database backup schedule and Point-in-Time Recovery policy.
The correct workflow adheres to cloud security dependency management and resource hierarchy principles. First, pre-requisite IAM permissions must be granted to the Cloud Spanner Service Agent on the Cloud KMS key in the security project. Second, the parent Cloud Spanner instance must be provisioned. Third, the Cloud Spanner database is created while passing the CMEK key URI so that initial storage allocation is encrypted with the custom key. Fourth, DDL statements are executed against the running database to establish tables and indexes. Fifth, automated backup schedules and PITR retention policies are configured to protect the initialized schema and incoming data.

Step-by-Step Solution

1
Grant Cloud KMS IAM Role to Service Agent
The Spanner Service Agent receives permission to call Cloud KMS encrypt and decrypt operations.
If permissions are missing when database creation is invoked, the CMEK authorization check fails immediately.
2
Provision Cloud Spanner Instance
Compute node/processing unit resources and multi-region replication topology are allocated.
Cloud Spanner databases exist logically within a parent Cloud Spanner instance environment.
3
Create Spanner Database with CMEK Parameter
An encrypted database container is initialized with underlying storage bound to the specified Cloud KMS key.
CMEK settings in Cloud Spanner cannot be applied retroactively after standard Google-managed key creation.
4
Apply DDL Schema Definitions
Tables, interleave relationships, indexes, and database-level IAM access roles are created.
Database schema definition requires an active, accessible database target.
5
Attach Automated Backup Schedule Policy
Recurring snapshot backups and PITR windows are activated for operational disaster recovery.
Backup policies protect populated data structures and rely on the complete schema setup.

Key Concept

Cloud Spanner Provisioning and CMEK Integration Workflow
Rate this question

Topics

Provisioning Storage and Database Systems

More questions from this topic