Examkin

Question

Difficulty: HardProvisioning Storage and Database Systems

A logistics enterprise is deploying an automated deployment pipeline to provision a database for order management limited to a single GCP region. The application requires ACID transactional consistency to handle localized regional traffic, a strict RPO of zero across two zones, and compliance mandates requiring storage encryption keys to be managed directly within Cloud KMS. Furthermore, the infrastructure operations team must manage the deployment declaratively using Terraform without risking local state file corruption or concurrent state writes. Which configuration approach fulfills these database provisioning and infrastructure management requirements?

  1. Provision a Cloud SQL for PostgreSQL High Availability instance configured with Customer-Managed Encryption Keys (CMEK) via Cloud KMS, and configure the Terraform remote backend to store state in a Cloud Storage bucket with object versioning and state locking enabled.Answer
  2. B
    Provision a multi-region Cloud Spanner instance configured with Customer-Managed Encryption Keys (CMEK) via Cloud KMS, and configure the Terraform remote backend to store state in a Cloud Storage bucket with object versioning and state locking enabled.
  3. C
    Provision a Cloud SQL for PostgreSQL High Availability instance configured with Customer-Supplied Encryption Keys (CSEK) passed directly in API calls, and configure the Terraform remote backend to store state in a Cloud Storage bucket with object versioning and state locking enabled.
  4. D
    Provision a Cloud SQL for PostgreSQL High Availability instance configured with Customer-Managed Encryption Keys (CMEK) via Cloud KMS, and track the local terraform.tfstate file directly within a private Git repository for automated pipeline execution.

Answer

Provision a Cloud SQL for PostgreSQL High Availability instance configured with Customer-Managed Encryption Keys (CMEK) via Cloud KMS, and store Terraform state in a Cloud Storage backend with object versioning and locking enabled.
Provisioning Cloud SQL for PostgreSQL in a High Availability configuration satisfies single-region relational storage requirements with zonal redundancy. Utilizing Customer-Managed Encryption Keys (CMEK) satisfies the requirement to leverage Cloud KMS for key management. Using a Cloud Storage bucket with object versioning and state locking for the Terraform backend ensures state security, consistency, and protection against concurrent execution conflicts.

Step-by-Step Solution

1
Analyze regional storage and database requirement boundary.
Cloud SQL for PostgreSQL in High Availability (HA) regional configuration meets ACID requirements with automatic zonal failover (RPO=0) without incurring multi-region Cloud Spanner costs.
Cloud Spanner is designed for globally distributed workloads; Cloud SQL HA is optimized for single-region relational workloads.
2
Evaluate key management compliance requirement.
Configure CMEK using Cloud KMS key rings and service account permissions.
CMEK allows central lifecycle governance inside Google Cloud KMS, whereas CSEK requires raw key management outside Cloud KMS.
3
Determine Infrastructure as Code remote state management pattern.
Configure Terraform backend to use Google Cloud Storage (gcs) with object versioning and native state locking.
Remote state backends in GCS prevent race conditions, state corruption, and credential exposure associated with local or version-control state storage.

Key Concept

Provisioning Cloud Database Infrastructure with CMEK and IaC Remote State Locking
Rate this question

Topics

Provisioning Storage and Database Systems

More questions from this topic