Examkin

Question

Difficulty: Very hardAdvising Development and Operation Teams

A financial technology company's platform operations and development teams manage infrastructure across Google Cloud projects using an external CI/CD pipeline and Terraform. The teams face two critical operational issues: CI/CD deployments rely on long-lived service account JSON keys stored in third-party runner secrets, creating a security compliance risk; additionally, developers frequently perform manual emergency configuration changes in the Cloud Console, causing severe state drift and deployment pipeline failures. As the Cloud Architect advising these teams on Google Cloud best practices, which TWO actions should you recommend to remediate these security and operational challenges while adhering to the principle of least privilege? (Select TWO.)

  1. Configure Workload Identity Federation to allow the external CI/CD runner to exchange short-lived OpenID Connect (OIDC) tokens for GCP IAM service account credentials without using downloadable JSON keys.Answer
  2. Restrict manual write access to cloud resources via IAM permission boundaries, and integrate automated continuous drift detection using Cloud Asset Inventory or scheduled Terraform plan runs.Answer
  3. C
    Assign the primitive Owner IAM role to the deployment service account across all managed projects to guarantee automated pipelines possess uninhibited execution privileges.
  4. D
    Grant developers the Service Account Admin role in production so they can quickly regenerate and manually export new service account JSON keys during emergency deployment failures.
  5. E
    Allow developers to maintain local unversioned state files on their workstations when hotfixing resources in the Cloud Console to avoid central state storage locking conflicts.

Answer

The recommended solutions are implementing Workload Identity Federation for keyless external authentication and enforcing IAM least-privilege policies alongside automated continuous drift detection.
Advising operations and development teams effectively requires enforcing security and operational reliability. Utilizing Workload Identity Federation eliminates the high risk of leaked long-lived service account keys by converting external CI/CD runner identities into short-lived GCP tokens. Concurrently, removing manual write privileges while deploying automated drift detection enforces Infrastructure as Code integrity, ensuring all environment updates proceed transparently through audited version-controlled pipelines.

Step-by-Step Solution

1
Address key management security risk
Replace exported service account JSON keys with Workload Identity Federation to allow short-lived OIDC credential exchanges from the external CI/CD system.
Google Cloud security best practices mandate avoiding long-lived, exportable service account keys wherever Workload Identity Federation can be used.
2
Address infrastructure drift and manual console edits
Revoke direct manual write permissions from developers in production and enforce changes through IaC pipelines combined with automated drift monitoring.
Preventative IAM controls stop manual console drift at the source, while detective controls identify any discrepancies between live cloud state and declared IaC manifests.

Key Concept

CI/CD Credential Management and IaC Governance
Rate this question

Topics

Advising Development and Operation Teams

More questions from this topic