Examkin

Question

Difficulty: MediumProvisioning Storage and Database Systems

An organization is provisioning infrastructure for a standard regional e-commerce application operating in a single Google Cloud region. The solution requires a relational database system optimized for cost and single-region transactional performance without global distribution overhead. Additionally, the DevOps team must provision a shared remote backend for Infrastructure as Code (Terraform) state management that prevents concurrent state modifications, protects against accidental deletion/corruption through state recovery, and adheres to key management governance using Cloud KMS. Which architectural provisioning strategy meets these requirements?

  1. Provision a Cloud SQL instance for the database workload, and store the Terraform state in a Cloud Storage bucket configured with object versioning and Customer-Managed Encryption Keys (CMEK) via Cloud KMS.Answer
  2. B
    Provision a multi-region Cloud Spanner instance for the database workload, and store the Terraform state in a regional Cloud Storage bucket without object versioning.
  3. C
    Provision a Cloud SQL instance for the database workload, and maintain the Terraform state file on a local persistent disk attached to a centralized deployment virtual machine.
  4. D
    Provision a Cloud SQL instance for the database workload, and configure a Cloud Storage bucket using Customer-Supplied Encryption Keys (CSEK) provided via raw key strings for the remote state backend.

Answer

Provision a Cloud SQL instance for the database workload, and store the Terraform state in a Cloud Storage bucket configured with object versioning and Customer-Managed Encryption Keys (CMEK) via Cloud KMS.
The correct strategy provisions Cloud SQL, which accurately fits the single-region relational requirement without incurring unnecessary Cloud Spanner overhead. Storing the Terraform remote state in Cloud Storage with object versioning enabled ensures state backup recovery, native backend state locking, and encryption governed by Cloud KMS (CMEK).

Step-by-Step Solution

1
Select the appropriate database service based on regional scale requirements.
Cloud SQL is selected over Cloud Spanner because the application is confined to a single region and requires standard relational database capabilities without multi-region global replication overhead.
Cloud Spanner is designed for globally distributed, multi-region SQL workloads and adds unnecessary cost for single-region applications.
2
Design the Infrastructure as Code (Terraform) remote state storage strategy.
A Cloud Storage (GCS) bucket with object versioning enabled is chosen to store the remote Terraform state file.
GCS provides native state locking through Terraform backend integration and object versioning allows restoring past states in case of corruption.
3
Apply key governance controls to the storage backend.
Enforce CMEK using Cloud KMS keys on the GCS bucket.
CMEK integration satisfies internal key management governance while leveraging Cloud KMS for lifecycle and rotation management.

Key Concept

Provisioning Cloud SQL and configuring secure Cloud Storage remote state backends with CMEK and versioning for Terraform.
Rate this question

Topics

Provisioning Storage and Database Systems

More questions from this topic