Examkin

Soru

Zorluk: OrtaProvisioning Storage and Database Systems

An enterprise architecture team needs to provision a mission-critical Cloud Bigtable instance to store real-time IoT telemetry data. The regulatory compliance framework requires that persistent data be encrypted using Customer-Managed Encryption Keys (CMEK) and that all database traffic remain isolated within the private network via Private Services Access (PSA). What is the correct sequence of steps to provision this storage infrastructure securely?

  1. 1Create a Cloud KMS KeyRing and CryptoKey in the target region, and grant the Cloud Bigtable Service Agent (`service-[PROJECT_NUM]@gcp-sa-bigtable.iam.gserviceaccount.com`) the Cloud KMS CryptoKey Encrypter/Decrypter role.
  2. 2Reserve an internal IP address range in the custom Virtual Private Cloud (VPC) network and establish a Private Services Access connection to `servicenetworking.googleapis.com`.
  3. 3Create the Cloud Bigtable instance by specifying the instance type, cluster identifier, and the Cloud KMS CryptoKey resource URI for disk encryption.
  4. 4Configure the Cloud Bigtable cluster location, node count, and storage type to finalize instance deployment inside the private service network boundary.

Cevap

The correct sequence starts with creating the Cloud KMS key and granting the Encrypter/Decrypter role to the Cloud Bigtable Service Agent. Next, allocate an internal IP range and establish the Private Services Access VPC peering connection. Then, create the Cloud Bigtable instance referencing the CMEK key URI. Finally, configure and provision the cluster within the instance attached to the private network topology.
Provisioning database resources with custom encryption and private networking requires strict ordering of security and infrastructure dependencies. First, key access must be granted to the service agent so encryption verification succeeds during storage creation. Second, Private Services Access must be established so private IP addresses can be assigned to the instance nodes. Third, the instance is created referencing the CMEK key. Finally, the cluster is provisioned within the created instance and connected to the private network topology.

Adım Adım Çözüm

1
Configure CMEK and IAM permissions
Cloud Bigtable Service Agent possesses necessary permissions to access the KMS CryptoKey.
GCP service APIs reject storage resource provisioning if the service account cannot access the specified CMEK key.
2
Establish Private Services Access (PSA)
IP allocation and Service Networking VPC peering connection created between VPC and Google producer network.
Private connectivity requires pre-allocated CIDR blocks to avoid address collisions when provisioning cluster endpoints.
3
Provision the Cloud Bigtable instance using CMEK
Bigtable instance created with persistent disks bound to the KMS key.
Instance creation references the pre-configured CMEK key URI established in Step 1.
4
Deploy and finalize cluster parameters
Cluster initialized with target node count and storage type inside the private VPC network.
Cluster topology deployment relies on both the active instance shell and established Private Services Access network.

Anahtar Kavram

Dependency ordering for GCP database provisioning with CMEK encryption and Private Services Access
Bu soruyu puanla

Konular

Provisioning Storage and Database Systems

Bu konudan daha fazla soru