Examkin

Soru

Zorluk: ZorProvisioning Storage and Database Systems

A global financial services platform is migrating its core ledger database to Google Cloud. The system requires a relational database that provides ACID compliance across multiple geographic regions with automatic multi-region failover and horizontal write scalability. Security governance demands that data at rest be encrypted using keys managed in Cloud KMS, with key permissions granted following the principle of least privilege prior to resource creation. Which provisioning strategy should the cloud architecture team implement to meet these technical and compliance requirements?

  1. Provision a Cloud Spanner instance with a multi-region configuration, grant the Cloud KMS CryptoKey Encrypter/Decrypter role to the Cloud Spanner service agent, and reference the CMEK key URI during database creation.Cevap
  2. B
    Provision a Cloud SQL for PostgreSQL instance with High Availability enabled across multiple zones, configure cross-region read replicas, and set up manual failover routines for regional outages.
  3. C
    Provision a multi-region Cloud Spanner instance by supplying 256-bit raw customer-supplied encryption keys directly in the API call headers during database creation.
  4. D
    Provision a multi-region Cloud Spanner instance using local Terraform state files stored on the operator workstation to manage resource dependencies and key encryption bindings.

Cevap

Provision a Cloud Spanner instance with a multi-region configuration, grant the Cloud KMS CryptoKey Encrypter/Decrypter role to the Cloud Spanner service agent, and reference the CMEK key URI during database creation.
The scenario requires horizontal write scalability across multiple geographic regions combined with strict ACID compliance. Cloud Spanner is Google Cloud's fully managed relational database built specifically for global scale and multi-region automatic availability. To enforce CMEK encryption, the Cloud Spanner service agent must be granted the Cloud KMS CryptoKey Encrypter/Decrypter role prior to database instantiation.

Adım Adım Çözüm

1
Evaluate database requirements for multi-region scale and transactional integrity
Identify Cloud Spanner as the target database service, as Cloud SQL cannot provide global multi-region horizontal write scaling.
Cloud Spanner delivers synchronous multi-region replication and globally distributed ACID transactions.
2
Determine the security and encryption provisioning process
Identify Customer-Managed Encryption Keys (CMEK) via Cloud KMS as the required encryption mechanism.
Cloud Spanner does not support raw CSEK keys, making CMEK via Cloud KMS mandatory for custom key control.
3
Establish key access permissions prior to resource creation
Grant `roles/cloudkms.cryptoKeyEncrypterDecrypter` to the Cloud Spanner service agent (`[email protected]`).
The service account must have explicit permissions to encrypt and decrypt using the specified KMS key before database creation can succeed.

Anahtar Kavram

Provisioning Cloud Spanner with Customer-Managed Encryption Keys (CMEK)
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Provisioning Storage and Database Systems

Bu konudan daha fazla soru