Examkin

Question

Difficulty: HardInfrastructure as Code and Environment Provisioning

Your organization is establishing an automated, enterprise-grade Infrastructure as Code (IaC) deployment pipeline for Google Cloud using Terraform and Cloud Build. Arrange the steps in the correct operational sequence to securely provision a new production environment while ensuring remote state locking, policy-as-code governance, and zero static credential storage.

  1. 1Authenticate the Cloud Build runner to Google Cloud using Workload Identity Federation to obtain short-lived credentials for the IaC Service Account.
  2. 2Run `terraform init` to configure the backend and acquire an automatic state lock on the designated Cloud Storage bucket.
  3. 3Execute `terraform plan` to output a speculative execution plan file and evaluate it against automated policy-as-code rules (such as Sentinel or OPA).
  4. 4Submit the validated plan artifact to the Security and Infrastructure team for mandatory peer review and gate approval.
  5. 5Execute `terraform apply` using the approved plan file artifact to provision infrastructure and release the remote state lock.

Answer

The correct operational sequence for provisioning infrastructure via IaC is: 1) Authenticate via Workload Identity Federation; 2) Run `terraform init` to initialize the workspace and lock the Cloud Storage state backend; 3) Run `terraform plan` and execute automated policy-as-code compliance checks; 4) Submit the speculative plan artifact for formal peer approval; 5) Run `terraform apply` with the approved plan file to provision resources and release the backend state lock.
Following Google Cloud SRE and enterprise IaC best practices, automated environment provisioning requires a strict sequence. First, the runner authenticates keylessly using Workload Identity Federation. Second, `terraform init` establishes remote state locking in Cloud Storage to block conflicting parallel executions. Third, a speculative `terraform plan` is evaluated using automated policy-as-code guardrails. Fourth, the generated plan artifact undergoes mandatory peer review to fulfill change management requirements. Finally, `terraform apply` executes the approved plan artifact and releases the backend lock.

Step-by-Step Solution

1
Authenticate runner via Workload Identity Federation
Pipeline receives temporary IAM service account token
Eliminates long-lived service account key security risks in automated CI/CD pipelines.
2
Initialize Terraform backend with Cloud Storage state locking
Backend initialized and Cloud Storage object lock acquired
Ensures state consistency and protects state files from concurrent mutation.
3
Generate speculative execution plan and run policy-as-code validation
Speculative plan created and validated against security guardrails
Catches misconfigurations and policy violations prior to actual resource creation.
4
Submit plan artifact for human review and approval gate
Approval recorded for the immutable plan file
Enforces governance controls and prevents plan drift between review and deployment.
5
Apply approved plan artifact and release state lock
GCP resources created/updated and backend state lock released
Executes the precise reviewed state changes idempotently.

Key Concept

Infrastructure as Code Provisioning Workflow and State Locking Lifecycle
Rate this question

Topics

Infrastructure as Code and Environment Provisioning