Your company wants to migrate their 10-TB on-premises database export into Cloud Storage. You want to minimize the time it takes to complete this activity, the overall cost, and database load. The bandwidth between the on-premises environment and Google Cloud is 1 Gbps. You want to follow Google-recommended practices. What should you do?
Answer(s): B
The optimal solution is B. Use the Data Transfer appliance to perform an offline migration. This approach best addresses the requirements of minimizing transfer time, cost, and database load while adhering to Google-recommended practices for large data migrations.Option B leverages the Data Transfer Appliance, which is designed for securely shipping large datasets offline when network bandwidth limitations are a bottleneck. Given the 1 Gbps bandwidth and 10TB of data, an online transfer would be time-consuming. The appliance bypasses the network constraint, accelerating the migration. This offline approach also minimizes load on the database since no active querying or data streaming is occurring during the shipping process.Option A, using Dataflow, would require reading data directly from the database, potentially impacting its performance during the extraction phase. While Dataflow is powerful for data processing, it is not optimal for initial migration of large static data volumes. Option C, using a commercial ETL solution, adds unnecessary cost and complexity. These solutions often involve recurring fees and could potentially introduce compatibility challenges. Option D, while beneficial, does not tackle the fundamental bandwidth limitation and the time impact of transferring 10 TB over a 1 Gbps connection; compression reduces the size, but not the time impact of the network bottleneck.The Data Transfer Appliance aligns with Google's recommended practices for large-scale data ingestion, particularly when network bandwidth is a limiting factor. It provides secure, efficient, and relatively cost-effective means for migrating substantial data volumes.Supporting Links:Google Cloud Data Transfer Service: https://cloud.google.com/data-transfer/ Data Transfer Appliance Documentation: https://cloud.google.com/transfer-appliance/docs Choosing a data transfer method: https://cloud.google.com/storage/docs/transfer-data
Your company has an enterprise application running on Compute Engine that requires high availability and high performance. The application has been deployed on two instances in two zones in the same region in active-passive mode. The application writes data to a persistent disk. In the case of a single zone outage, that data should be immediately made available to the other instance in the other zone. You want to maximize performance while minimizing downtime and data loss. What should you do?
Answer(s): C
The correct answer is C, utilizing a regional SSD persistent disk. This approach directly addresses the requirement for high availability, minimal downtime, and data consistency during a zone outage.Here's why: Regional persistent disks synchronously replicate data across two zones within a region. This inherent redundancy ensures that if one zone experiences an outage, the data is immediately available in the other zone. With a regional persistent disk, you can simply force-attach the disk to the standby instance in the healthy zone, enabling a near-instantaneous failover without requiring complex data restoration procedures. This minimizes both downtime and potential data loss compared to other options.Option A, relying on snapshots, introduces a delay during failover as the disk would need to be recreated from the snapshot. This would lead to greater downtime and potential data loss depending on snapshot frequency. Option B, using Cloud Storage, introduces latency because of network access and is not ideal for high-performance database workloads. Option D, local SSDs coupled with rsync, will not meet the high availability requirement. In addition, local SSDs are ephemeral and data would be lost if instance terminated. The rsync approach is also not synchronous and involves a manual failover process that contributes to increased downtime.By using a regional persistent disk, the application can achieve rapid failover with no data loss, fulfilling the need for both high availability and minimal disruption. It is also a low complexity solution that leverages built-in GCP capabilities.Authoritative links:Regional persistent disks: https://cloud.google.com/compute/docs/disks#regional_pd Choosing a storage option: https://cloud.google.com/storage/docs/choose-storage-option
You are designing a Data Warehouse on Google Cloud and want to store sensitive data in BigQuery. Your company requires you to generate the encryption keys outside of Google Cloud. You need to implement a solution. What should you do?
Answer(s): D
The correct answer is D because it directly addresses the requirement of using externally generated encryption keys for BigQuery data while adhering to best practices. Options A, B, and C are less suitable due to various reasons.Option A utilizes Cloud KMS-generated keys, which contradicts the requirement of external key generation. Storing data in Cloud Storage first and then decrypting through Dataflow adds unnecessary complexity and latency. Option B also employs a Cloud KMS-generated key, failing to address the need for imported keys. While it directly targets BigQuery, the key source is incorrect. Option C correctly identifies the need to import a key into Cloud KMS but incorrectly suggests a Cloud Storage intermediary and Dataflow processing. This adds unnecessary steps.Option D, however, correctly addresses the requirements. Importing an external key into Cloud KMS satisfies the need for externally generated keys. Using the customer-supplied key option (not "customer-managed" as in Options A,B,C) directly within BigQuery allows for the seamless application of this key during dataset creation, which then encrypts the data at rest within BigQuery. This method avoids complex data pipelines and maintains a direct encryption approach.In essence, option D utilizes the "customer-supplied encryption key" (CSEK) feature of BigQuery, where the user imports their own key material into Cloud KMS, retaining control of key generation and storage outside of Google Cloud. This offers the highest level of control over sensitive data encryption.Authoritative Links:BigQuery Customer-Managed Encryption Keys: https://cloud.google.com/bigquery/docs/customer-managed-encryption - While this page describes the CMK feature (which uses Cloud KMS-generated keys), it provides context for where the user supplied key option is applicable. Cloud KMS import key: https://cloud.google.com/kms/docs/importing-keys - This documentation explains how external keys can be imported into Cloud KMS. BigQuery Customer-Supplied Encryption Keys: https://cloud.google.com/bigquery/docs/customer-supplied-encryption - This is the specific documentation outlining the usage of CSEK in BigQuery.
Your organization has stored sensitive data in a Cloud Storage bucket. For regulatory reasons, your company must be able to rotate the encryption key used to encrypt the data in the bucket. The data will be processed in Dataproc. You want to follow Google-recommended practices for security. What should you do?
The correct answer is B . This approach leverages Cloud KMS, Google's managed key management service, to control the encryption keys used for Cloud Storage buckets. Setting the encryption key on the bucket to a Cloud KMS key ensures that data within the bucket is encrypted using the specified key. Crucially, Cloud KMS facilitates key rotation, a key requirement of the prompt, enabling compliance with regulatory requirements by regularly changing encryption keys, bolstering security, and reducing the impact of potential key compromises. This is achieved through the built-in rotation capabilities of KMS where new key versions can be created, and older versions are no longer used, while maintaining access to older encrypted data. This automated rotation simplifies compliance and maintenance significantly. This approach also adheres toGoogle's recommended security practices, using managed service to handle sensitive key management instead of manually handling keys. It is a server-side encryption approach, meaning the data is encrypted by the cloud service, not by the client. Option A is incorrect because it manually encrypts data using Cloud KMS before upload. This approach adds complexity and is not how Cloud Storage's server-side encryption with KMS is intended to be used. Options C and D involve creating and managing the encryption keys outside of Google Cloud, losing the advantages of managed services and increasing operational complexity. They don't readily provide easy key rotation as KMS does. Moreover, Cloud Storage has native integration with KMS.Supporting Concepts and Links:Cloud Key Management Service (KMS): A managed service for creating, managing, and rotating cryptographic keys. https://cloud.google.com/kms/docs Cloud Storage Encryption: Details on using customer-managed encryption keys (CMEK) with Cloud Storage, including integration with Cloud KMS. https://cloud.google.com/storage/docs/encryption/customer-managed-keys Key Rotation: Importance and best practices of rotating encryption keys for enhanced security and compliance. https://cloud.google.com/kms/docs/key-rotation Server-Side Encryption: How Google manages data at rest encryption. https://cloud.google.com/security/encryption-at-rest
Your team needs to create a Google Kubernetes Engine (GKE) cluster to host a newly built application that requires access to third-party services on the internet. Your company does not allow any Compute Engine instance to have a public IP address on Google Cloud. You need to create a deployment strategy that adheres to these guidelines. What should you do?
Answer(s): A
The correct answer is A. Configure the GKE cluster as a private cluster, and configure Cloud NAT Gateway for the cluster subnet. Here's why:A private GKE cluster ensures that nodes do not have public IP addresses, fulfilling the requirement that no Compute Engine instance should have a public IP. This enhances security by limiting exposure to the internet. However, without public IPs, GKE nodes cannot directly access external services on the internet. This is where Cloud NAT comes into play. Cloud NAT provides outbound internet connectivity for GKE nodes by performing Network Address Translation. It allows private instances within a VPC to connect to the internet through a shared public IP address associated with the NAT Gateway, avoiding direct exposure. This aligns perfectly with the restriction on public IPs and ensures external service accessibility. Option B, configuring Private Google Access, enables communication with Google services but does not provide access to third-party services on the public internet. Option C, using a route-based cluster, doesn't address the public IP restriction, and Private Google Access has the same limitation as option B. Option D, a NAT proxy, introduces a single point of failure and is more complex to manage compared to Cloud NAT. Therefore, option A provides the optimal combination of security and connectivity.Supporting Links:Private clusters: https://cloud.google.com/kubernetes-engine/docs/how-to/private-clusters Cloud NAT: https://cloud.google.com/nat/docs/overview Private Google Access: https://cloud.google.com/vpc/docs/private-access-options#private-google-access
Post your Comments and Discuss Google Google Cloud Architect Professional exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the Google Cloud Architect Professional content, but please register or login to continue.