Examkin

Question

Difficulty: Very hardDesigning Infrastructure for Technical Requirements and High Availability

A global telemetry platform processes real-time device status payloads ingested across North America and Europe. The workload experiences sudden 10x traffic spikes and requires high availability with minimal operational infrastructure management during low-traffic periods. Additionally, security compliance mandates that sensitive payload logs stored in Cloud Storage must be protected against data exfiltration, ensuring that compromised identity credentials alone cannot copy data to unauthorized external storage buckets outside the corporate perimeter. Which TWO architecture design choices should be implemented to satisfy these technical and availability requirements? (Select TWO choices.)

  1. Deploy the HTTP ingestion workload using Cloud Run across multiple regions, configured behind a Global External Application Load Balancer with serverless Network Endpoint Groups (NEGs).Answer
  2. Configure VPC Service Controls around the project resources and define a security perimeter encompassing Cloud Storage services to restrict data egress to authorized networks.Answer
  3. C
    Provision a multi-zone Google Kubernetes Engine (GKE) cluster running Cluster Autoscaler and Horizontal Pod Autoscaler to manage the HTTP ingestion containers.
  4. D
    Enforce granular IAM Conditions and predefined Storage Object Viewer roles on the Cloud Storage bucket to prevent external data transfer.
  5. E
    Configure load balancer health checks to directly query the backend database service to verify end-to-end data pipeline health prior to routing HTTP traffic.

Answer

The correct combination requires using Cloud Run deployed across multiple regions behind a Global External Application Load Balancer with serverless NEGs for stateless autoscaling HTTP ingestion, alongside VPC Service Controls to establish a security perimeter preventing data exfiltration from Cloud Storage.
Combining multi-region Cloud Run deployments behind a Global External Application Load Balancer with serverless NEGs delivers seamless multi-region high availability and rapid autoscaling without keeping idle compute instances running. Pairing this compute tier with VPC Service Controls around Cloud Storage isolates bucket access within a designated security perimeter, preventing compromised IAM credentials from copying internal data to non-permitted external storage targets.

Step-by-Step Solution

1
Analyze compute tier high availability and scaling requirements.
Identified that stateless HTTP ingestion with zero-idle cost and sudden 10x traffic spikes is best served by regional Cloud Run instances behind a Global External Application Load Balancer using serverless NEGs.
GKE requires ongoing cluster administration and baseline node costs, whereas Cloud Run provides fully managed serverless scale-to-zero capabilities with global load balancing.
2
Analyze security and data exfiltration constraints.
Identified that preventing credential-based data exfiltration to external storage buckets requires network perimeter controls via VPC Service Controls.
IAM authorization validates identity but cannot block an authorized user or compromised key from copying objects into an external project outside the corporate perimeter.

Key Concept

Designing multi-region serverless architectures for variable scale and enforcing network perimeters with VPC Service Controls for exfiltration prevention.
Rate this question

Topics

Designing Infrastructure for Technical Requirements and High Availability