Examkin

Question

Difficulty: HardProvisioning Storage and Database Systems

A software platform team is automating the provisioning of infrastructure for a single-region transactional order processing system. The architecture requires a relational database deployed across two availability zones for high availability. Compliance guidelines mandate that storage encryption keys must be managed in Cloud KMS with custom rotation control, avoiding direct handling of raw encryption keys by the application team. Additionally, the team must protect the automated deployment pipeline state against concurrency conflicts and state file overwrites. Which combination of provisioning configurations fulfills these requirements?

  1. Provision a Cloud SQL for PostgreSQL regional high-availability instance configured with Customer-Managed Encryption Keys (CMEK) referencing Cloud KMS, and store the Terraform state in a Cloud Storage remote backend configured with Object Versioning and state locking.Answer
  2. B
    Provision a multi-region Cloud Spanner instance configured with Cloud KMS CMEK keys, and store the Terraform deployment state in a standard Cloud Storage bucket without versioning enabled.
  3. C
    Provision a Cloud SQL for PostgreSQL regional high-availability instance configured with Customer-Supplied Encryption Keys (CSEK) provided via raw key headers, and maintain the Terraform state file on an attached persistent disk.
  4. D
    Provision a Cloud SQL for PostgreSQL regional high-availability instance configured with CMEK, but maintain the Terraform state file in a local git repository to handle concurrent locks.

Answer

Provision a Cloud SQL for PostgreSQL regional high-availability instance configured with Customer-Managed Encryption Keys (CMEK) referencing Cloud KMS, and store the Terraform state in a Cloud Storage remote backend configured with Object Versioning and state locking.
Provisioning Cloud SQL regional HA fulfills the regional dual-zone uptime requirement. Using Customer-Managed Encryption Keys (CMEK) integrates directly with Cloud KMS to satisfy enterprise key management and rotation policies without transmitting raw keys. Storing Terraform state in Cloud Storage with Object Versioning and native locking prevents concurrency conflicts during automated provisioning pipelines.

Step-by-Step Solution

1
Evaluate the database tier requirements
Identify that a single-region relational database with dual-zone high availability is best served by Cloud SQL regional HA rather than globally distributed Cloud Spanner.
Cloud SQL regional HA provides automated cross-zone failover within a single GCP region at optimal cost for standard transactional workloads.
2
Evaluate encryption key management constraints
Select Customer-Managed Encryption Keys (CMEK) integrated with Cloud KMS.
CMEK allows central organization control over key rotation and IAM policies in Cloud KMS without forcing administrators to hold and transmit raw encryption keys (which is required by CSEK).
3
Evaluate Infrastructure as Code (IaC) state backend requirements
Select Google Cloud Storage remote backend with state locking and Object Versioning.
Cloud Storage native state locking prevents concurrent terraform apply collisions while Object Versioning enables state recovery in case of accidental corruption.

Key Concept

Provisioning Cloud SQL with CMEK and securing remote IaC state backends
Rate this question

Topics

Provisioning Storage and Database Systems

More questions from this topic