Examkin

Question

Difficulty: MediumDesigning Infrastructure for Technical Requirements and High Availability

A global logistics enterprise is architecting its core shipment dispatch backend on Google Cloud. The application requires multi-region high availability with continuous write availability (RPO=0RPO = 0), global ACID transaction guarantees across regions, and zero-downtime regional failover. Furthermore, microservices hosted on internal Compute Engine instances must query the database securely without traversing the public internet, while preventing internal users from exfiltrating data to external Cloud Storage buckets or projects. Which architecture meets these technical and availability requirements?

  1. Deploy Cloud Spanner with a multi-region instance configuration, configure Private Google Access for Compute Engine subnets, and implement a VPC Service Controls perimeter around the project resources.Answer
  2. B
    Deploy Cloud SQL for PostgreSQL with high availability (HA) enabled across zones in a primary region and cross-region read replicas in a secondary region, relying on IAM permissions to prevent data exfiltration.
  3. C
    Deploy Cloud Spanner with a multi-region instance configuration, relying exclusively on granular IAM roles and VPC firewall rules to prevent data exfiltration to external resources.
  4. D
    Deploy Compute Engine microservices across two VPC networks connected via VPC Network Peering through a central transit VPC, relying on transitive routing to access Cloud Spanner in a multi-region setup.

Answer

Deploying Cloud Spanner with a multi-region configuration alongside Private Google Access and VPC Service Controls fulfills all technical, high availability, and anti-exfiltration constraints.
The combination of Cloud Spanner in a multi-region deployment, Private Google Access, and VPC Service Controls addresses all stated architecture needs. Cloud Spanner delivers multi-region ACID consistency with zero data loss (RPO=0RPO = 0), Private Google Access keeps database communication on private Google infrastructure, and VPC Service Controls prevents authorized identities from exporting data outside designated perimeter boundaries.

Step-by-Step Solution

1
Evaluate database requirements for multi-region ACID transactions and RPO=0.
Cloud Spanner multi-region instance deployment is selected because it provides synchronous cross-region replication, RPO=0, and high availability (99.999% SLA).
Cloud SQL provides regional HA but uses asynchronous replication for cross-region read replicas, failing the zero RPO requirement.
2
Determine private routing requirements for internal Compute Engine microservices.
Private Google Access is enabled on the subnets housing Compute Engine instances.
Allows instances without public IP addresses to reach Google APIs and Cloud Spanner endpoints over internal Google network paths.
3
Address data exfiltration security requirements.
VPC Service Controls perimeters are configured around the project.
IAM roles grant permission to access data but cannot restrict where authorized data is written. VPC Service Controls blocks data movement to non-designated external projects or storage locations.

Key Concept

Multi-Region High Availability & Security Perimeters
Rate this question

Topics

Designing Infrastructure for Technical Requirements and High Availability