Examkin

Question

Difficulty: MediumAssessing and Mitigating Technical Debt in Cloud Architectures

A smart grid energy utility completed a rapid migration of its customer metering infrastructure to Google Cloud. A post-migration technical debt assessment identified two key architecture issues: simple stateless HTTP ingestion microservices are currently running on self-managed Compute Engine virtual machines requiring manual OS patching and fixed compute costs, and sensitive meter telemetry stored in Cloud Storage buckets remains vulnerable to data exfiltration by authorized identity credentials operating outside the enterprise network perimeter. Which TWO architectural mitigations should the Cloud Architect recommend to resolve this technical debt?

  1. Refactor the stateless HTTP ingestion microservices to deploy on Cloud Run to eliminate server maintenance and enable automatic scaling to zero.Answer
  2. B
    Migrate the stateless HTTP microservices to a multi-zone Google Kubernetes Engine (GKE) cluster with autoscaling node pools.
  3. Configure VPC Service Controls around the Cloud Storage resources storing telemetry data to establish a secure perimeter against exfiltration.Answer
  4. D
    Rely exclusively on Cloud IAM predefined bucket-level roles to prevent telemetry data exfiltration.
  5. E
    Grant the ingestion service accounts the Project Owner primitive role to simplify permission management across all resources.

Answer

The optimal mitigations are refactoring the stateless HTTP microservices to Cloud Run and establishing a VPC Service Controls perimeter around Cloud Storage.
Migrating simple stateless HTTP ingestion microservices to Cloud Run eliminates server patching and reduces baseline costs by scaling to zero when idle. Establishing VPC Service Controls creates a security perimeter around Cloud Storage to prevent data exfiltration, even if authorized IAM credentials are used outside the perimeter.

Step-by-Step Solution

1
Analyze the operational compute overhead of the ingestion services.
Simple stateless HTTP services hosted on Compute Engine introduce unnecessary operational debt such as OS maintenance, patching, and non-zero baseline compute expenses.
Cloud Run natively handles containerized stateless HTTP microservices with zero cluster management and automatic scaling to zero.
2
Analyze the security boundary for data exfiltration protection.
Cloud IAM authenticates and authorizes identities but does not restrict egress destination networks or prevent copy operations by compromised authorized credentials.
VPC Service Controls form a network perimeter around Google Cloud services like Cloud Storage to block unauthorized data movements outside designated perimeters.

Key Concept

Mitigating operational and security technical debt using Cloud Run and VPC Service Controls
Rate this question

Topics

Assessing and Mitigating Technical Debt in Cloud Architectures