A global renewable energy utility company is designing the cloud infrastructure on Google … — Google Cloud Professional Cloud Architect

A global renewable energy utility company is designing the cloud infrastructure on Google Cloud for its smart grid control and monitoring platform. The architecture must ingest real-time telemetry from control centers and maintain high availability for critical transactional grid operations across multiple geographic regions.

The technical requirements are:
- Zero Recovery Point Objective ( $RPO = 0$ ) and a Recovery Time Objective ( $RTO < 1\text{ minute}$ ) for global transactional grid state storage during regional outages.
- High-throughput, SLA-backed hybrid network connectivity requiring $20\text{ Gbps}$ of dedicated bandwidth between on-premises control centers and Google Cloud VPCs.
- Prevention of data exfiltration from Cloud Storage telemetry buckets, ensuring users with valid IAM read permissions cannot copy telemetry data to storage buckets in external projects.

Which TWO architectural choices should the cloud architect implement to satisfy these high availability, throughput, and security requirements? (Select TWO.)

Provision a multi-region Cloud Spanner configuration across the required regions to host the transactional grid state.Answer
Establish redundant 10 Gbps Dedicated Interconnect circuits and configure a VPC Service Controls perimeter around the project's Cloud Storage resources.Answer
C
Deploy a regional Cloud SQL for PostgreSQL database with cross-region asynchronous read replicas for grid state storage.
D
Configure multiple High Availability (HA) VPN tunnels with dynamic Cloud Router BGP peering over the public internet to achieve 20 Gbps bandwidth.
E
Enforce strict IAM viewer roles combined with Customer-Managed Encryption Keys (CMEK) on Cloud Storage to restrict telemetry data exfiltration.

Answer

The correct architecture consists of provisioning a multi-region Cloud Spanner instance for synchronous cross-region transactional storage (

RPO = 0

), establishing redundant 10 Gbps Dedicated Interconnect circuits for 20 Gbps hybrid throughput, and configuring a VPC Service Controls perimeter around Cloud Storage to mitigate data exfiltration.

Provisioning a multi-region Cloud Spanner instance fulfills the strict technical constraint of zero RPO and sub-minute RTO through synchronous multi-region Paxos consensus replication. Deploying Dedicated Interconnect guarantees 20 Gbps SLA-backed throughput between on-premises and GCP VPCs, while wrapping Cloud Storage within a VPC Service Controls perimeter blocks users from copying sensitive telemetry data outside the designated project boundaries.

Step-by-Step Solution

Evaluate data persistence requirements for RPO = 0 and RTO < 1 minute across global locations.

Identify that Cloud Spanner with a multi-region configuration uses synchronous Paxos replication across regions, meeting RPO = 0. Cloud SQL relies on asynchronous cross-region replicas which incur replication lag and non-zero RPO.

High availability for globally distributed transactional databases with zero RPO mandates multi-region Cloud Spanner.

Evaluate network throughput requirements between on-premises data centers and GCP.

Dedicated Interconnect provides direct 10 Gbps or 100 Gbps physical links with formal SLAs, easily supporting 20 Gbps via redundant connections. HA VPN tunnels max out around 3 Gbps per tunnel and travel over the uncommitted public internet.

Bandwidth demands of 20 Gbps require Dedicated Interconnect rather than HA VPN.

Evaluate data exfiltration protection requirements.

VPC Service Controls create a security perimeter preventing data from being copied out of designated project resources to unauthorized external storage buckets. IAM and CMEK alone do not enforce perimeter boundary isolation.

Preventing authorized users from exfiltrating data outside the environment requires VPC Service Controls.

Key Concept

Designing Multi-Region High Availability, High-Throughput Hybrid Connectivity, and Data Exfiltration Prevention in GCP

Estimated Time:2m 30s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics