Examkin

Soru

Zorluk: ZorProvisioning Storage and Database Systems

An enterprise platform engineering team is automating the provisioning of storage buckets and relational database instances using Infrastructure as Code (IaC). Corporate security mandates using key management where key rotation and access permissions are managed via cloud identity and access management policies without developers needing to handle or transmit raw encryption keys. Additionally, the team's automated CI/CD pipeline must prevent concurrent execution state corruption and maintain a history of infrastructure state changes for rollback safety. Which TWO actions should the team include in their provisioning architecture to fulfill these requirements?

  1. Provision Customer-Managed Encryption Keys (CMEK) via Cloud KMS and pass the key resource identifiers to the storage bucket and database instance resource blocks.Cevap
  2. Configure a Cloud Storage remote backend for Infrastructure as Code state storage with object versioning and state locking enabled.Cevap
  3. C
    Generate Customer-Supplied Encryption Keys (CSEK) and embed raw 256-bit key strings into the local provider variables for database and storage resource provisioning.
  4. D
    Maintain the Infrastructure as Code state files in a local directory committed to a shared Git version control repository to handle concurrency and version tracking.

Cevap

The team must provision Customer-Managed Encryption Keys (CMEK) using Cloud KMS to meet key governance requirements without managing raw keys, and configure a Cloud Storage remote backend with state locking and object versioning to protect Infrastructure as Code state integrity.
Provisioning Customer-Managed Encryption Keys (CMEK) via Cloud KMS satisfies organizational governance by leveraging managed key rotation and IAM-based key delegation without exposing raw key secrets. Configuring a Cloud Storage remote backend with object versioning and state locking secures state integrity against concurrent pipeline writes while preserving state history for operational recovery.

Adım Adım Çözüm

1
Analyze encryption management requirements
Selected Customer-Managed Encryption Keys (CMEK) integrated with Cloud KMS over Customer-Supplied Encryption Keys (CSEK).
CMEK allows organizational key policies and rotation via IAM without exposing raw keys in IaC code or requiring manual key management.
2
Analyze Infrastructure as Code state requirements
Selected Cloud Storage remote state backend with state locking and object versioning.
Remote state locking prevents concurrent modifications by multiple pipeline execution workers, while object versioning maintains historical snapshots for audit and disaster recovery rollback.

Anahtar Kavram

Provisioning Database/Storage with CMEK and IaC Remote State Locking
Bu soruyu puanla

Konular

Provisioning Storage and Database Systems

Bu konudan daha fazla soru