Examkin

Question

Difficulty: MediumProvisioning Storage and Database Systems

A financial services firm is provisioning a relational database on Google Cloud to process transactional ledger records confined strictly within a single GCP region. The system architecture requires full ACID compliance, automated point-in-time recovery, multi-zone high availability, and customer-managed encryption keys (CMEK) integrated with Cloud KMS. The platform engineering team must manage all infrastructure using Terraform and ensure that multiple engineers can execute provisioning safely without risk of state corruption or concurrent execution conflicts. Which architecture provisioning design fulfills all business and operational requirements?

  1. Provision a Cloud SQL instance configured for High Availability using Customer-Managed Encryption Keys (CMEK), and configure the Terraform remote backend in a Cloud Storage bucket with object versioning and state locking enabled.Answer
  2. B
    Provision a multi-region Cloud Spanner instance configured with Customer-Managed Encryption Keys (CMEK), and store the Terraform state in a Cloud Storage bucket with object versioning and state locking enabled.
  3. C
    Provision a Cloud SQL instance configured for High Availability using Customer-Supplied Encryption Keys (CSEK) passed via environment variables, and store the Terraform state in a Cloud Storage bucket with object versioning enabled.
  4. D
    Provision a Cloud SQL instance configured for High Availability using Customer-Managed Encryption Keys (CMEK), while storing the Terraform state file in an unversioned local directory synced across engineers via cloud file backup.

Answer

Deploy a Cloud SQL instance with High Availability enabled and CMEK encryption, while maintaining Terraform state in a remote Cloud Storage bucket with object versioning and state locking.
The correct strategy leverages Cloud SQL to fulfill single-region high-availability relational requirements with CMEK integration, combined with a Google Cloud Storage Terraform remote backend configured with object versioning and state locking to protect infrastructure state during team operations.

Step-by-Step Solution

1
Select the appropriate database service based on regional scale and transactional requirements.
Cloud SQL provides full ACID compliance, regional HA across zones, and native CMEK encryption without the high cost and global overhead of Cloud Spanner.
The scenario explicitly mandates single-region transactional processing, making Cloud SQL the optimal relational database engine.
2
Select the appropriate encryption key model.
Customer-Managed Encryption Keys (CMEK) via Cloud KMS meet organizational enterprise security policies while enabling key lifecycle management in GCP.
CMEK allows central control and auditing in Cloud KMS without forcing administrators to maintain raw CSEK key material.
3
Configure the Infrastructure as Code (IaC) state management strategy.
A Cloud Storage remote backend using object versioning and state locking via Cloud Storage prevents race conditions and state corruption.
Multi-engineer teams require explicit lock management and backup history when running Terraform automation.

Key Concept

Provisioning Cloud SQL database instances with CMEK and managing Terraform state securely via remote GCS backends.
Rate this question

Topics

Provisioning Storage and Database Systems

More questions from this topic