A healthcare research organization needs to migrate its core data assets to Google Cloud w… — Google Cloud Professional Cloud Architect

A healthcare research organization needs to migrate its core data assets to Google Cloud within a strict 6-week timeframe. The workload consists of $3.5\text{ PB}$ of static genomic sequence files on an on-premises SAN and an active $15\text{ TB}$ transactional PostgreSQL database. The facility has a single $1\text{ Gbps}$ dedicated internet connection. The migration plan must ensure minimal database downtime with continuous synchronization, and governance rules mandate strict perimeter security controls to prevent data exfiltration to unauthorized external cloud resources. Which TWO architectural strategies should you incorporate into the migration design?

Utilize Google Cloud Transfer Appliance devices to perform an offline bulk migration of the $3.5\text{ PB}$ genomic dataset, and deploy Database Migration Service (DMS) with continuous Change Data Capture (CDC) for the PostgreSQL database.Answer
Configure VPC Service Controls around the target Cloud Storage buckets and database instances to establish a secure perimeter and block unauthorized data movement.Answer
C
Use Storage Transfer Service over the existing $1\text{ Gbps}$ connection to transfer the $3.5\text{ PB}$ genomic dataset directly to Cloud Storage buckets.
D
Rely strictly on custom IAM roles and bucket-level IAM policies on Cloud Storage to prevent data exfiltration across organizational boundaries.

Answer

The correct architecture requires ordering Transfer Appliance devices for the petabyte-scale static dataset while using Database Migration Service with CDC for continuous database replication, combined with VPC Service Controls to prevent perimeter data exfiltration.

Moving

3.5\text{ PB}

over a

1\text{ Gbps}

network connection is mathematically impossible within 6 weeks, making offline Transfer Appliance devices mandatory for the static storage. Database Migration Service with CDC handles the live PostgreSQL replication. VPC Service Controls provide the required network perimeter boundary to safeguard against exfiltration to outside GCP projects.

Step-by-Step Solution

Calculate data transfer throughput for the

3.5\text{ PB}

static dataset.

1\text{ Gbps}

, uploading

3.5\text{ PB}

online requires

\frac{3.5 \times 10^{15} \times 8}{10^9 \times 86400} \approx 324

days. This violates the 6-week constraint, necessitating an offline transfer solution like Transfer Appliance.

Petabyte-scale data transfers over constrained WAN links require physical offline hardware appliances.

Select database replication mechanism for zero/minimal downtime.

Database Migration Service (DMS) utilizing Change Data Capture (CDC) allows continuous replication of PostgreSQL WAL logs up to the final cutover window.

CDC minimizes operational downtime by allowing live transactional databases to sync continuously.

Select perimeter security mechanism to address data exfiltration requirements.

VPC Service Controls form a logical perimeter isolating target Cloud Storage and database resources.

VPC Service Controls prevent data egress to unauthorized GCP projects even if an identity has legitimate IAM read permissions.

Key Concept

Selecting data transfer appliances vs online transfer services based on bandwidth limitations, paired with VPC Service Controls for perimeter exfiltration defense.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics