Examkin

Soru

Zorluk: OrtaProvisioning Storage and Database Systems

A media streaming company is deploying a regional user profile microservice on Google Cloud that requires a relational database with high availability across zones. Company policy mandates that all database data at rest must be encrypted using key management controls in Cloud KMS to meet compliance audit requirements without managing raw encryption keys manually. The operations team uses Terraform to manage cloud resources and must maintain state file integrity during automated deployments. Which provisioning strategy meets these architectural, compliance, and infrastructure management requirements?

  1. Provision a Cloud SQL PostgreSQL instance configured for High Availability across multiple zones, integrated with a Cloud KMS key for Customer-Managed Encryption Keys (CMEK), and store the Terraform state in a Cloud Storage bucket with object versioning enabled.Cevap
  2. B
    Provision a Cloud Spanner multi-region instance integrated with Cloud KMS encryption, and store the Terraform state in a Cloud Storage bucket with object versioning enabled.
  3. C
    Provision a Cloud SQL PostgreSQL instance configured for High Availability using Customer-Supplied Encryption Keys (CSEK) specified via raw 256-bit key strings in Terraform configuration variables, and store the state in Cloud Storage.
  4. D
    Provision a Cloud SQL PostgreSQL instance configured for High Availability using a Cloud KMS key for Customer-Managed Encryption Keys (CMEK), while storing the Terraform state file in a local directory committed to the project's Git repository.

Cevap

Provision a Cloud SQL PostgreSQL instance configured for High Availability across multiple zones, integrated with a Cloud KMS key for Customer-Managed Encryption Keys (CMEK), and store the Terraform state in a Cloud Storage bucket with object versioning enabled.
The correct response combines appropriate database service sizing (Cloud SQL for regional high-availability relational needs), cloud-native key governance (CMEK with Cloud KMS), and enterprise IaC best practices (remote state storage in Cloud Storage with versioning).

Adım Adım Çözüm

1
Select the appropriate database service for regional scope.
Choose Cloud SQL instead of Cloud Spanner because the application is a regional relational microservice that does not require global multi-region scalability.
Cloud SQL provides zonal and regional high availability at a cost-effective scale for standard relational database needs.
2
Select the proper encryption mechanism for Cloud KMS compliance.
Configure Customer-Managed Encryption Keys (CMEK) referencing a Cloud KMS key ring and key.
CMEK allows central governance and audit control over key access in Cloud KMS without taking on the operational burden of raw Customer-Supplied Encryption Keys (CSEK).
3
Configure secure Infrastructure as Code (IaC) state management.
Configure a remote Cloud Storage backend for Terraform with object versioning and state locking enabled.
Centralized, versioned remote state storage prevents concurrent execution conflicts, state corruption, and accidental deletion.

Anahtar Kavram

Cloud SQL Provisioning with CMEK and IaC Remote State Management
Bu soruyu puanla

Konular

Provisioning Storage and Database Systems

Bu konudan daha fazla soru