Examkin

Soru

Zorluk: OrtaProvisioning Storage and Database Systems

A global logistics organization is establishing an automated Infrastructure as Code (IaC) deployment pipeline to provision a transactional relational database handling order processing across North America and Europe. The workload requires multi-continent scale with strict ACID transaction guarantees. Security governance mandates that encryption keys must be managed through a centralized cloud key management service rather than requiring client applications to transmit raw key material during API operations. Additionally, the engineering team requires that the IaC state configuration prevents concurrent modification conflicts and supports state recovery. Which combination of database service, key management model, and IaC state storage best satisfies these requirements?

  1. Provision Cloud Spanner configured with Customer-Managed Encryption Keys (CMEK) stored in Cloud KMS, and configure the Terraform remote backend using a Cloud Storage bucket with object versioning and state locking enabled.Cevap
  2. B
    Provision Cloud SQL for PostgreSQL configured with Customer-Managed Encryption Keys (CMEK) stored in Cloud KMS, and store the Terraform state file in a Cloud Storage bucket with object versioning enabled.
  3. C
    Provision Cloud Spanner configured with Customer-Supplied Encryption Keys (CSEK) provided in each API header, and maintain the Terraform state file locally within a shared version-controlled Git repository.
  4. D
    Provision Cloud Spanner configured with Customer-Managed Encryption Keys (CMEK) stored in Cloud KMS, and store the Terraform state in an unversioned Cloud Storage bucket without state locking.

Cevap

Provision Cloud Spanner using Customer-Managed Encryption Keys (CMEK) in Cloud KMS, combined with a Cloud Storage Terraform backend that enables object versioning and state locking.
The correct strategy combines Cloud Spanner (which natively delivers multi-continent global ACID relational transactions), Customer-Managed Encryption Keys via Cloud KMS (fulfilling corporate key governance without raw key transmission), and a Cloud Storage remote backend for Terraform featuring object versioning and state locking (protecting IaC state integrity).

Adım Adım Çözüm

1
Evaluate database requirements for multi-continent ACID transactions
Identify Cloud Spanner as the required storage system because Cloud SQL does not scale across multiple continents with active-active relational consistency.
Cloud Spanner uses TrueTime and distributed consensus to deliver globally distributed relational ACID transactions.
2
Identify key management requirements
Select Customer-Managed Encryption Keys (CMEK) backed by Cloud KMS rather than Customer-Supplied Keys (CSEK).
CMEK allows central policy governance and automated rotation via Cloud KMS without forcing client applications to store or transmit raw key material.
3
Determine automated IaC state management best practices
Configure a remote backend on Cloud Storage with both object versioning and state locking enabled.
State locking prevents concurrent executions from corrupting the state file, and object versioning allows recovery from accidental state corruption.

Anahtar Kavram

Provisioning globally distributed relational databases with CMEK and securing IaC state backends
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Provisioning Storage and Database Systems

Bu konudan daha fazla soru