Examkin

Question

Difficulty: MediumSelecting and Designing Storage and Database Resources

A retail organization is migrating its regional order-processing application to Google Cloud. The application requires a relational database operating strictly within a single Google Cloud region, supporting standard SQL transactions, strong consistency, and automatic multi-zone failover. The expected data dataset size is 350 GB with a peak load of 2,500 operations per second. Additionally, corporate security policy dictates that encryption keys must be managed in Cloud KMS with key rotation controlled by the security team. Which database and key management solution should the cloud architect recommend?

  1. Deploy Cloud SQL for PostgreSQL configured with High Availability (multi-zone) and encrypted using Customer-Managed Encryption Keys (CMEK) via Cloud KMS.Answer
  2. B
    Deploy a multi-region Cloud Spanner instance configured with Customer-Managed Encryption Keys (CMEK) via Cloud KMS.
  3. C
    Deploy Cloud SQL for PostgreSQL configured with High Availability (multi-zone) using Customer-Supplied Encryption Keys (CSEK) supplied in every API call.
  4. D
    Deploy Cloud SQL for PostgreSQL using basic IAM database authentication alone, assuming IAM permissions sufficiently prevent unauthorized data egress to external Google Cloud Storage buckets.

Answer

Deploy Cloud SQL for PostgreSQL configured with High Availability (multi-zone) and encrypted using Customer-Managed Encryption Keys (CMEK) via Cloud KMS.
Cloud SQL for PostgreSQL with High Availability provides a fully managed relational database with multi-zone redundancy tailored for single-region workloads. Utilizing Customer-Managed Encryption Keys (CMEK) integrated with Cloud KMS fulfills security requirements for customer control over key lifecycles without raw key handling overhead.

Step-by-Step Solution

1
Analyze storage data model and scaling scope requirements
The application requires a standard relational ACID database operating entirely within a single region for 350 GB of data.
Single-region relational workloads of this scale are best served by Cloud SQL rather than globally distributed systems like Cloud Spanner.
2
Determine high availability architecture
Cloud SQL High Availability deployment provisions a primary instance and a synchronous standby instance across two zones in the same region.
This guarantees multi-zone automatic failover satisfying high availability requirements.
3
Evaluate key management security compliance
Cloud KMS Customer-Managed Encryption Keys (CMEK) allow the customer security team to hold key management responsibility while delegating service-level encryption transparently to Google Cloud services.
CMEK meets governance requirements without requiring raw key transmission (CSEK).

Key Concept

Selecting Cloud SQL HA vs Cloud Spanner for regional relational workloads and integrating CMEK
Rate this question

Topics

Selecting and Designing Storage and Database Resources