Examkin

Soru

Zorluk: ZorDesigning Infrastructure for Technical Requirements and High Availability

A digital media enterprise is architecting an event ingestion microservice on Google Cloud to handle HTTP webhooks triggered by external partners. The workload is stateless, highly bursty, and experiences prolonged idle periods. The architecture must automatically scale to zero during periods of inactivity to eliminate baseline compute costs, sustain high availability across zonal failures, and enforce strict security boundaries that prevent compromised internal service accounts from copying sensitive data to external Cloud Storage buckets outside the enterprise environment. Which architectural strategy best satisfies these technical, availability, and security requirements?

  1. Deploy the microservice on Cloud Run fully managed, connect it to a Virtual Private Cloud (VPC) network using a Serverless VPC Access connector, and enclose the project resources within a VPC Service Controls perimeter.Cevap
  2. B
    Deploy the microservice on a multi-zonal Google Kubernetes Engine (GKE) cluster configured with Cluster Autoscaler and horizontal pod autoscaling, relying on IAM custom roles to restrict bucket destination permissions.
  3. C
    Deploy the microservice on Cloud Run fully managed with direct public egress, configuring IAM Least Privilege principles and Cloud KMS encryption on all storage buckets without perimeter security controls.
  4. D
    Deploy the microservice on Compute Engine virtual machines across multiple zones using an unpeered spoke VPC, relying on a central transit VPC peered to a target data VPC to route egress storage traffic transitively.

Cevap

Deploying the stateless microservice on Cloud Run attached to the VPC via Serverless VPC Access inside a VPC Service Controls perimeter satisfies scale-to-zero operational efficiency, high availability, and exfiltration prevention.
Cloud Run satisfies the technical requirement for a stateless HTTP workload that must scale down to zero instances during idle periods while providing native regional high availability across zones. Pairing Cloud Run with Serverless VPC Access and placing resources inside a VPC Service Controls perimeter guarantees that internal services cannot exfiltrate data to external storage destinations, fulfilling all stated security and availability criteria.

Adım Adım Çözüm

1
Evaluate compute high availability and scale-to-zero cost requirements for stateless HTTP workloads.
Cloud Run is selected over GKE or Compute Engine MIGs because it scales automatically from zero to thousands of container instances and handles regional multi-zone deployment without baseline infrastructure costs during idle periods.
Simple stateless HTTP microservices with unpredictable bursty traffic benefit from serverless compute to minimize management overhead and cost.
2
Evaluate network security controls to satisfy data exfiltration prevention requirements.
VPC Service Controls must be implemented around the project and storage resources.
IAM permissions control who has access to resources, but VPC Service Controls define a security perimeter preventing data movement to resources outside the perimeter.
3
Integrate serverless compute with private network security boundaries.
A Serverless VPC Access connector routes egress traffic from Cloud Run into the private VPC network where perimeter policies apply.
Ensures Cloud Run instances can securely access internal network services and adhere to perimeter security restrictions.

Anahtar Kavram

Designing highly available serverless compute architectures paired with VPC Service Controls for exfiltration protection
Bu soruyu puanla

Konular

Designing Infrastructure for Technical Requirements and High Availability