Examkin

Soru

Zorluk: OrtaProvisioning Storage and Database Systems

A platform engineering team is configuring automated infrastructure provisioning for a single-region transactional order processing system. The database must support standard relational SQL capabilities, provide automatic multi-zone failover within the region, and enforce data encryption at rest using keys rotated via Google Cloud KMS. Furthermore, the Infrastructure as Code (IaC) pipeline managed by multiple engineers must prevent concurrent state modifications and state corruption. Which architecture and provisioning setup fulfills these operational requirements?

  1. Provision a Cloud SQL instance configured for Regional High Availability with Customer-Managed Encryption Keys (CMEK), using a Cloud Storage backend with object versioning and state locking for Terraform state management.Cevap
  2. B
    Provision a multi-region Cloud Spanner instance with Customer-Supplied Encryption Keys (CSEK), using a Cloud Storage backend with object versioning and state locking for Terraform state management.
  3. C
    Provision a Cloud SQL instance configured for Regional High Availability with Customer-Supplied Encryption Keys (CSEK), using local unversioned storage to maintain the Terraform state file.
  4. D
    Provision a Cloud SQL instance configured for Regional High Availability with Customer-Managed Encryption Keys (CMEK), using a standard Cloud Storage bucket without versioning or object locking enabled for Terraform state.

Cevap

Provision a Cloud SQL instance configured for Regional High Availability with Customer-Managed Encryption Keys (CMEK), using a Cloud Storage backend with object versioning and state locking for Terraform state management.
Cloud SQL Regional High Availability fulfills standard relational database requirements in a single region with automated zonal failover. Using Customer-Managed Encryption Keys (CMEK) allows key integration with Cloud KMS, fulfilling centralized rotation compliance. Enabling object versioning and state locking on the Cloud Storage backend ensures state integrity and concurrency protection for Infrastructure as Code automation.

Adım Adım Çözüm

1
Select database service according to architectural scope
Cloud SQL Regional HA is selected over Cloud Spanner because the system is strictly single-region and requires standard relational database capabilities without multi-region global scale overhead.
Cloud SQL provides automatic cross-zone failover within a single region at optimal cost and complexity.
2
Choose encryption key strategy based on key management requirements
Customer-Managed Encryption Keys (CMEK) integrated with Cloud KMS are selected rather than Customer-Supplied Encryption Keys (CSEK).
CMEK allows organization control over key lifecycle and rotation policies within GCP Cloud KMS without requiring management of raw key bytes.
3
Configure backend state storage for IaC automation
Cloud Storage bucket backend is configured with object versioning and state locking enabled.
State locking prevents race conditions during concurrent execution, and versioning enables recovery in case of accidental corruption.

Anahtar Kavram

Provisioning Cloud SQL with CMEK and managing IaC state with lock-enabled Cloud Storage backends.
Bu soruyu puanla

Konular

Provisioning Storage and Database Systems

Bu konudan daha fazla soru