Examkin

Soru

Zorluk: Çok zorSelecting and Designing Storage and Database Resources

A regional financial enterprise is building a core transaction processing system hosted entirely in a single Google Cloud region (us-east4). The workload requires full SQL compliance, complex table joins, strict ACID transactional consistency, high availability with automatic cross-zone failover, and point-in-time recovery. The enterprise security policy dictates that encryption keys must be managed centrally by the internal security team using Cloud KMS with automated key rotation. To control operational expenditure, the enterprise explicitly wants to avoid paying for globally distributed database infrastructure when regional scope is sufficient. Which storage and database architecture should you recommend to meet these requirements?

  1. Deploy Cloud SQL for PostgreSQL configured with High Availability (HA) across multiple zones within the region, and configure Customer-Managed Encryption Keys (CMEK) using Cloud KMS.Cevap
  2. B
    Deploy a multi-region Cloud Spanner instance configured with Customer-Managed Encryption Keys (CMEK) integrated with Cloud KMS.
  3. C
    Deploy Cloud SQL for PostgreSQL configured with High Availability (HA) across multiple zones, and implement Customer-Supplied Encryption Keys (CSEK) managed in local application deployment manifests.
  4. D
    Deploy a single-zone Cloud SQL instance with IAM database authentication enabled, relying on strict IAM permission controls alone to prevent data exfiltration across the perimeter.

Cevap

Deploy Cloud SQL for PostgreSQL configured with High Availability (HA) across multiple zones within the region, and configure Customer-Managed Encryption Keys (CMEK) using Cloud KMS.
The option advocating Cloud SQL for PostgreSQL configured with High Availability and Customer-Managed Encryption Keys (CMEK) directly addresses all requirements. High Availability mode provisions a standby instance in a second zone within the target region to guarantee automatic failover and point-in-time recovery for relational ACID transactions. CMEK leverages Cloud KMS for key governance as required by security policy, while avoiding the cost overhead of multi-region database engines.

Adım Adım Çözüm

1
Analyze database functional and spatial scope requirements.
The application requires relational SQL capabilities, ACID compliance, and zone redundancy within a single GCP region without requiring multi-region global replication.
Matching workload scope prevents over-provisioning expensive global resources.
2
Evaluate database service suitability.
Cloud SQL for PostgreSQL with High Availability provides cross-zone synchronous replication and automatic failover within a single region, satisfying all operational needs cost-effectively.
Cloud Spanner provides global multi-region scale but introduces unnecessary expense and complexity for single-region requirements.
3
Evaluate encryption key management governance constraints.
Customer-Managed Encryption Keys (CMEK) via Cloud KMS allow central security teams to control and rotate key access policies natively in GCP.
CMEK meets centralized Cloud KMS key management policies, whereas CSEK requires manual application-side key handling.

Anahtar Kavram

Selecting optimal regional relational storage services and CMEK encryption architecture based on architectural scope and cost governance.
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Selecting and Designing Storage and Database Resources