Examkin

Question

Difficulty: MediumAnalyzing Software Development Lifecycle (SDLC) and CI/CD Pipelines

An autonomous vehicle telemetry company manages its infrastructure deployments across Google Cloud environments using Cloud Build and Infrastructure as Code (Terraform). An internal architecture audit revealed two operational security vulnerabilities in the CI/CD pipeline: the pipeline executes using over-privileged default credentials, and concurrent deployment pipelines occasionally cause state file corruption and configuration race conditions. Which TWO actions should the cloud architect implement to address these vulnerabilities and optimize the SDLC pipeline? (Select TWO)

  1. Configure Cloud Build triggers to execute under a custom service account assigned only the minimal predefined roles required for resource provisioning.Answer
  2. B
    Assign the primitive Owner role (roles/owner) to the default Cloud Build service account to ensure uninterrupted execution across all GCP resources.
  3. Configure a Cloud Storage remote backend for Terraform state files with object versioning and state locking enabled.Answer
  4. D
    Store Terraform state files locally inside the CI/CD build workspace and commit them to source control after every build execution.
  5. E
    Grant the Cloud Build service account the Service Account Admin role (roles/iam.serviceAccountAdmin) at the organization level so it can impersonate service accounts.

Answer

The cloud architect should configure Cloud Build triggers to run under a custom service account with least-privilege roles, and store Terraform state in a Cloud Storage backend configured with state locking and object versioning.
Optimizing CI/CD pipelines for GCP infrastructure requires securing pipeline execution identities and ensuring concurrent state consistency. Executing Cloud Build triggers via a custom service account tailored with fine-grained roles enforces least privilege. Using Google Cloud Storage as a remote backend for Terraform state provides built-in locking mechanisms that prevent multiple build workers from causing state corruption.

Step-by-Step Solution

1
Analyze pipeline identity and access requirements.
Identified that replacing default service accounts with a dedicated custom service account bound to specific predefined roles enforces least-privilege security.
Default build service accounts often carry broad permissions that expose projects to unauthorized modifications.
2
Analyze state management requirements for Infrastructure as Code in automated pipelines.
Identified that centralizing state in Cloud Storage with backend state locking resolves concurrency conflicts.
Terraform Cloud Storage backend natively supports state locking, ensuring only one pipeline instance can mutate infrastructure state at a time.

Key Concept

CI/CD Pipeline Security and Infrastructure as Code (IaC) State Management
Rate this question

Topics

Analyzing Software Development Lifecycle (SDLC) and CI/CD Pipelines