Examkin

Question

Difficulty: MediumAssessing and Mitigating Technical Debt in Cloud Architectures

A biotechnology firm migrated its genomic research data pipelines to Google Cloud by manually creating Compute Engine instances and Cloud Storage buckets via the Google Cloud Console. To accelerate initial experimentation, development teams were granted primitive Owner roles across all GCP projects. A recent technical audit revealed significant operational risk due to untracked configuration drift and excessive user permissions. Which strategy should a Cloud Architect recommend to systematically assess and mitigate this technical debt?

  1. Import existing cloud resources into Infrastructure as Code (IaC) management, replace primitive roles with fine-grained predefined or custom IAM roles following least privilege, and enforce future changes exclusively through automated CI/CD pipelines.Answer
  2. B
    Retain manual resource management in the Google Cloud Console to minimize operational disruption, but downgrade developer permissions from Owner to Editor roles across all existing projects.
  3. C
    Write Terraform scripts for newly requested infrastructure moving forward while leaving previously created manual resources unmanaged, scheduling weekly manual console reviews to identify configuration changes.
  4. D
    Migrate all Compute Engine workloads and storage buckets directly to a multi-zonal Google Kubernetes Engine (GKE) cluster to enforce containerization standardizations without altering existing IAM resource structures.

Answer

Import existing cloud resources into Infrastructure as Code (IaC) management, replace primitive roles with fine-grained predefined or custom IAM roles following least privilege, and enforce future changes exclusively through automated CI/CD pipelines.
The optimal solution to remediate technical debt from ad-hoc console provisioning and excessive access is to codify existing infrastructure into Infrastructure as Code (IaC), establish least-privilege IAM roles (predefined or custom), and mandate CI/CD deployment pipelines to block manual console modifications and configuration drift.

Step-by-Step Solution

1
Identify and capture current cloud resource state
Discovered untracked manually provisioned Compute Engine instances and Cloud Storage buckets.
Before eliminating technical debt, all unmanaged assets must be cataloged and brought into declarative IaC (such as Terraform state).
2
Remediate IAM security debt by transitioning from primitive to least-privilege roles
Overly broad Owner roles are replaced with specific predefined roles (e.g., Storage Object Viewer, Compute Viewer) or custom roles.
Primitive roles grant excessive administrative privileges across entire projects, creating severe compliance and security risks.
3
Establish automated deployment governance via CI/CD pipelines
Direct console modifications are restricted, and all infrastructure updates require version-controlled IaC code reviews.
Automating deployments prevents manual out-of-band changes and eliminates future configuration drift.

Key Concept

Assessing and Mitigating Infrastructure Configuration Drift and IAM Technical Debt
Rate this question

Topics

Assessing and Mitigating Technical Debt in Cloud Architectures