Examkin

Question

Difficulty: MediumBuilding and Managing Infrastructure as Code (IaC)

A connected vehicle telemetry enterprise provisions its multi-region Google Cloud resources across multiple projects using Terraform managed by an automated CI/CD pipeline. The security and governance teams require that infrastructure state files are securely locked against concurrent writes and protected against state corruption, while CI/CD execution avoids using long-lived service account security keys. Additionally, the team must ensure that out-of-band manual changes are automatically identified before breaking deployment pipelines. Which TWO practices should the lead cloud architect implement to meet these requirements?

  1. Configure a remote Google Cloud Storage (GCS) backend with Object Versioning enabled and utilize Workload Identity Federation for CI/CD pipeline authentication.Answer
  2. B
    Store Terraform state files within the local filesystem of the CI/CD runner host and encrypt the state directory using Customer-Managed Encryption Keys (CMEK).
  3. C
    Grant the primitive Project Owner role to the pipeline service account to prevent permission errors across projects without rotating keys.
  4. Implement automated, scheduled terraform plan executions in the CI/CD pipeline to continuously evaluate real-world infrastructure against the target state configuration.Answer
  5. E
    Apply critical infrastructure fixes directly through the Google Cloud Console during emergency incidents without updating state files to save time.

Answer

The correct architecture requires configuring a remote Cloud Storage backend with Object Versioning combined with Workload Identity Federation for keyless authentication, alongside implementing automated scheduled terraform plan executions to detect infrastructure drift.
Configuring a Cloud Storage backend with versioning ensures robust remote state management with state locking and disaster recovery, while Workload Identity Federation allows external CI/CD runners to securely authenticate to GCP without managing persistent service account keys. Coupling this with automated scheduled terraform plan pipelines ensures that configuration drift caused by manual changes is promptly identified.

Step-by-Step Solution

1
Configure backend state security and pipeline authentication
Terraform state is stored in a centralized Cloud Storage bucket with object versioning and state locking, and short-lived tokens are issued via Workload Identity Federation.
Prevents state file corruption, concurrent modification issues, and eliminates long-lived service account key security vulnerabilities.
2
Establish continuous drift detection
Scheduled CI/CD workflows run terraform plan against live GCP project environments.
Identifies discrepancies between actual cloud resources and declared IaC templates created by unauthorized or manual Console actions.

Key Concept

Terraform Remote Backend Security, Keyless CI/CD Authentication, and Automated Drift Detection
Estimated Time:2m 0s
Rate this question

Topics

Building and Managing Infrastructure as Code (IaC)

More questions from this topic