Examkin

Question

Difficulty: MediumProvisioning Storage and Database Systems

A financial technology company is automating the infrastructure deployment of a regional order-processing database using Terraform. The database requires standard relational ACID capabilities within a single Google Cloud region, automated high-availability failover, and data encryption at rest managed through Cloud KMS. Furthermore, the engineering team must ensure that automated CI/CD execution of Terraform code prevents state corruption and concurrent execution locks when provisioning database and storage resources. Which configuration strategy should the cloud architect recommend?

  1. Provision a Cloud SQL instance with High Availability (regional failover) encrypted with Customer-Managed Encryption Keys (CMEK), and store the Terraform state in a Cloud Storage backend with object versioning and state locking enabled.Answer
  2. B
    Provision a multi-region Cloud Spanner instance encrypted with Customer-Managed Encryption Keys (CMEK), and store the Terraform state file in a shared local directory on the CI/CD build runner.
  3. C
    Provision a Cloud SQL instance with High Availability enabled using Customer-Supplied Encryption Keys (CSEK), and configure a Cloud Storage bucket backend for Terraform state.
  4. D
    Provision a Cloud SQL instance with High Availability enabled using Customer-Managed Encryption Keys (CMEK), and store the Terraform state file in an unversioned Google Cloud Storage bucket without state locking.

Answer

Provision a Cloud SQL instance configured for High Availability using Customer-Managed Encryption Keys (CMEK) via Cloud KMS, while managing Terraform state in a Cloud Storage backend configured with object versioning and state locking.
Cloud SQL satisfies the requirement for a single-region relational database with automated HA failover, fully supporting CMEK via Cloud KMS integration. Using Google Cloud Storage as a remote Terraform backend with state locking and object versioning ensures secure, concurrent-safe deployment operations.

Step-by-Step Solution

1
Evaluate database requirements
Cloud SQL PostgreSQL/MySQL provides regional single-region relational storage with high availability failover without the multi-region overhead of Cloud Spanner.
Matching single-region relational requirements with Cloud SQL optimizes cost and meets architectural objectives.
2
Select encryption management model
Configure Customer-Managed Encryption Keys (CMEK) via Cloud KMS.
Cloud SQL supports CMEK for centralized key governance, whereas CSEK is not supported on Cloud SQL.
3
Configure IaC state management
Use Google Cloud Storage backend for Terraform with state locking and versioning enabled.
Prevents concurrent deployment pipelines from causing race conditions or corrupting database infrastructure state.

Key Concept

Provisioning Cloud SQL with CMEK and securing IaC state management via Cloud Storage backends.
Rate this question

Topics

Provisioning Storage and Database Systems

More questions from this topic