A cloud administrator is provisioning database and storage resources for a regional web application. The application requires a standard relational database to support regional OLTP operations, and organization policies mandate that encryption key management must be handled within Google Cloud without requiring administrators to store or pass raw key material. Which of the following provisioning decisions should be implemented? (Select TWO.)
- Provision a Cloud SQL instance to serve the regional relational database workload.Answer
- BProvision Cloud Spanner as the relational database engine for the regional application.
- Configure Customer-Managed Encryption Keys (CMEK) using Cloud KMS to manage data encryption keys.Answer
- DConfigure Customer-Supplied Encryption Keys (CSEK) to supply raw cryptographic key material with each storage API request.
Answer
The correct provisioning choices are to deploy a Cloud SQL instance for the regional relational workload and to configure Customer-Managed Encryption Keys (CMEK) via Cloud KMS for key governance.
Selecting Cloud SQL fits standard regional relational requirements without the cost and complexity of global scaling services. Utilizing CMEK via Cloud KMS satisfies encryption governance requirements by allowing organizations to control key lifecycle and rotation policies natively without holding raw encryption key material.
Step-by-Step Solution
Key Concept
Provisioning Cloud SQL for regional relational databases and applying CMEK with Cloud KMS for managed encryption key control.