Examkin

Soru

Zorluk: Çok zorProvisioning Storage and Database Systems

A financial enterprise is deploying a mission-critical transactional ledger on Google Cloud. The system requires a relational database capable of providing global synchronous consistency, multi-region high availability, and horizontal write scalability. Regulatory compliance mandates that all data at rest must be encrypted using key management service integration (Cloud KMS) rather than raw keys managed by the application team. Additionally, all infrastructure must be provisioned using automated Terraform pipelines. To support concurrent pipeline runs and prevent configuration corruption, how should the database and infrastructure state management be configured?

  1. Provision Cloud Spanner across multiple regions with Customer-Managed Encryption Keys (CMEK) via Cloud KMS, and store the Terraform state in a Cloud Storage remote backend with object versioning and state locking enabled.Cevap
  2. B
    Provision a multi-zone Cloud SQL for PostgreSQL instance with Customer-Managed Encryption Keys (CMEK), and store the Terraform state file in an unversioned local directory within the CI/CD runner execution environment.
  3. C
    Provision Cloud Spanner across multiple regions with Customer-Managed Encryption Keys (CMEK), and store the Terraform state file in an unversioned Cloud Storage bucket without state locking.
  4. D
    Provision Cloud Spanner across multiple regions using Customer-Supplied Encryption Keys (CSEK) provided via API headers, and store the Terraform state in a Cloud Storage remote backend with state locking enabled.

Cevap

Provision Cloud Spanner across multiple regions with Customer-Managed Encryption Keys (CMEK) via Cloud KMS, and store the Terraform state in a Cloud Storage remote backend with object versioning and state locking enabled.
The correct solution selects Cloud Spanner to satisfy global consistency and horizontal write scalability, integrates CMEK via Cloud KMS to comply with encryption governance without taking on raw key management burdens, and uses a locked, versioned Cloud Storage remote backend to prevent state corruption during automated CI/CD pipeline deployments.

Adım Adım Çözüm

1
Evaluate database requirements for global relational transactions and horizontal scaling
Cloud Spanner is selected because Cloud SQL cannot scale write operations horizontally across multiple regions with global consistency.
Relational workloads requiring global scale and multi-region synchronous write availability require Cloud Spanner.
2
Evaluate encryption key management compliance requirements
Customer-Managed Encryption Keys (CMEK) using Cloud KMS are chosen over Customer-Supplied Encryption Keys (CSEK).
CMEK allows central policy enforcement and lifecycle management in Cloud KMS without forcing the application team to manage raw key binaries.
3
Establish secure Infrastructure as Code (IaC) state management
Configure a Terraform backend using Google Cloud Storage with object versioning and state locking enabled via Cloud Storage native lock mechanisms.
Remote state backends with locking prevent concurrent pipeline execution conflicts and enable recovery from accidental state corruption.

Anahtar Kavram

Cloud Spanner CMEK Provisioning & Terraform Remote State Management
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Provisioning Storage and Database Systems

Bu konudan daha fazla soru