Examkin

Question

Difficulty: MediumSelecting and Designing Storage and Database Resources

An enterprise SaaS provider is designing the database architecture for a multi-tenant accounting application deployed within a single Google Cloud region. The workload requires full ACID compliance, support for complex SQL relational queries, automatic regional high availability across zones, and data encryption governed via keys managed in Google Cloud KMS to comply with corporate security standards. The dataset is projected to grow to 2 TB over three years and does not require global multi-region read/write capabilities. Which storage solution should you recommend to satisfy these requirements with minimal operational complexity and cost?

  1. Deploy Cloud SQL for PostgreSQL configured in High Availability (HA) mode across two zones within the region, using Customer-Managed Encryption Keys (CMEK) integrated with Cloud KMS.Answer
  2. B
    Deploy Cloud Spanner configured across multiple regions with Customer-Managed Encryption Keys (CMEK) to guarantee global relational consistency.
  3. C
    Deploy Cloud SQL for PostgreSQL configured with Customer-Supplied Encryption Keys (CSEK) stored directly within application deployment configurations.
  4. D
    Deploy Cloud SQL for PostgreSQL with standard IAM role assignments to enforce security boundaries without configuring VPC Service Controls or encryption key policies.

Answer

Deploy Cloud SQL for PostgreSQL configured in High Availability (HA) mode across two zones within the region, using Customer-Managed Encryption Keys (CMEK) integrated with Cloud KMS.
The solution specifying Cloud SQL for PostgreSQL in High Availability (HA) mode with CMEK via Cloud KMS satisfies all architectural and security requirements. Cloud SQL supports full relational ACID semantics for single-region applications up to tens of terabytes. High Availability mode provisions a synchronous standby instance in a separate zone within the same region for automated failover. Utilizing CMEK through Cloud KMS fulfills key management governance policies efficiently.

Step-by-Step Solution

1
Analyze database model and scale requirements.
The application requires a traditional relational SQL database with ACID transactions and structured queries. The 2 TB dataset size and single-region footprint fit comfortably within Cloud SQL boundaries without requiring horizontally scalable global databases.
Matching database capability to actual scale avoids unnecessary resource overhead.
2
Evaluate availability and disaster recovery constraints.
Configuring Cloud SQL in High Availability (HA) mode creates a primary instance in one zone and a synchronous standby replica in a secondary zone, ensuring automatic failover during zonal outages.
Fulfills the regional high-availability constraint with fully managed failover logic.
3
Select the appropriate encryption key management mechanism.
Integrating Cloud SQL with Customer-Managed Encryption Keys (CMEK) via Google Cloud KMS enables centralized key management, key rotation policies, and compliance auditing without requiring manual raw key handling in application code.
Meets security governance requirements using Cloud KMS while maintaining managed cloud integration.

Key Concept

Selecting Cloud SQL HA with CMEK for Regional Relational Workloads
Rate this question

Topics

Selecting and Designing Storage and Database Resources