Examkin

Question

Difficulty: Very hardDesigning Infrastructure for Technical Requirements and High Availability

A global healthcare provider is designing a telemetry ingestion platform on Google Cloud for real-time monitoring of medical devices. The solution must achieve an SLA of 99.99% availability, zero Recovery Point Objective (RPO = 0) for incoming event streams, and seamlessly scale to absorb unpredictable traffic spikes without manual intervention. Additionally, strict security governance mandates that internal application services must be protected against data exfiltration to unauthorized external storage locations, even if service account credentials are compromised. Which architecture best satisfies these technical, availability, and security requirements with minimal operational overhead?

  1. Deploy stateless ingestion container services on Cloud Run in multiple GCP regions, fronted by a Global External Application Load Balancer with Serverless Network Endpoint Groups (NEGs), stream events directly into multi-region Cloud Pub/Sub, and enclose the Cloud Run and Pub/Sub resources within a VPC Service Controls perimeter.Answer
  2. B
    Deploy a Google Kubernetes Engine (GKE) Autopilot cluster in a single region with multi-zonal node pools running containerized ingestion microservices, buffer stream data using a highly available Cloud SQL for PostgreSQL database instance, and configure Horizontal Pod Autoscaling (HPA) based on CPU metrics.
  3. C
    Deploy Cloud Run services in a primary region fronted by a Regional External HTTP(S) Load Balancer, stream data into regional Cloud Storage buckets, and rely exclusively on fine-grained IAM service account roles to prevent application instances from transmitting data to external storage locations.
  4. D
    Deploy regional Compute Engine Managed Instance Groups (MIGs) across separate VPC networks connected via VPC Network Peering to a central shared VPC hub, relying on transitive routing across the peered VPCs to deliver telemetry traffic during a regional outage.

Answer

Deploy stateless ingestion container services on Cloud Run in multiple GCP regions, fronted by a Global External Application Load Balancer with Serverless NEGs, stream events into multi-region Cloud Pub/Sub, and enforce a VPC Service Controls perimeter around Cloud Run and Pub/Sub.
The correct solution leverages multi-region Cloud Run services fronted by a Global External Application Load Balancer with Serverless Network Endpoint Groups (NEGs) to ensure automatic failover and 99.99% availability with zero infrastructure management. Ingesting stream data via Cloud Pub/Sub guarantees zero RPO through multi-zone synchronous replication. Enclosing Cloud Run and Pub/Sub within a VPC Service Controls perimeter prevents unauthorized data exfiltration beyond defined network boundaries, satisfying all security governance mandates.

Step-by-Step Solution

1
Evaluate compute and load balancing for high availability (99.99% SLA) and operational overhead.
Multi-region Cloud Run behind a Global External Application Load Balancer using Serverless NEGs provides instant serverless auto-scaling and cross-region failover without infrastructure management.
Serverless containers handle unpredictable bursty telemetry workloads effortlessly while maintaining multi-region redundancy.
2
Evaluate data ingestion store for RPO = 0 streaming capabilities.
Cloud Pub/Sub configured across multiple regions synchronously replicates published messages across zones before acknowledging publish requests.
This guarantees zero RPO and durability against zonal and regional failures.
3
Evaluate security requirements for exfiltration prevention.
VPC Service Controls establishes a security boundary around GCP APIs and services (Cloud Run and Cloud Pub/Sub).
IAM roles specify WHO can access resources, but VPC Service Controls restricts WHERE data can move, blocking unauthorized transfers even if IAM credentials are compromised.

Key Concept

Designing multi-region serverless architectures with Global Load Balancing, Pub/Sub event streaming, and VPC Service Controls for exfiltration protection.
Rate this question

Topics

Designing Infrastructure for Technical Requirements and High Availability