Examkin

Question

Difficulty: HardAnalyzing Software Development Lifecycle (SDLC) and CI/CD Pipelines

A fintech firm is reviewing its release engineering workflow for managing Google Cloud infrastructure using automated Cloud Build pipelines. During a software development lifecycle (SDLC) audit, the enterprise architect identifies two major vulnerabilities in the CI/CD architecture: concurrent build executions fail due to local state lock conflicts on ephemeral worker nodes, and the Cloud Build service account has been granted the administrative `roles/iam.serviceAccountAdmin` role to attach runtime service accounts to Compute Engine instance groups. Which combination of architectural modifications should the cloud architect implement to resolve these operational and security issues?

  1. Migrate the state backend to a Cloud Storage bucket with object versioning and state locking enabled, and replace `roles/iam.serviceAccountAdmin` with `roles/iam.serviceAccountUser` on the target deployment service accounts.Answer
  2. B
    Store state files on an attached persistent disk shared across build triggers, and upgrade the Cloud Build service account privileges to `roles/owner` to avoid role-binding restrictions.
  3. C
    Retain `roles/iam.serviceAccountAdmin` on the Cloud Build service account to ensure uninterrupted deployment rights, while storing state files in unversioned Cloud Storage buckets.
  4. D
    Deploy VPC Service Controls around the Cloud Build network perimeter to prevent state data exfiltration, while maintaining local disk state storage and existing administrative IAM roles.

Answer

Migrate the state backend to a Cloud Storage bucket with object versioning and state locking enabled, and replace `roles/iam.serviceAccountAdmin` with `roles/iam.serviceAccountUser` on the target deployment service accounts.
The solution addresses both pipeline concurrency and security compliance. A Cloud Storage remote backend with locking ensures safe concurrent state mutations, while switching from Service Account Admin to Service Account User grants the minimum permission necessary to attach deployment identities to Compute Engine instances.

Step-by-Step Solution

1
Analyze the state management failure in the pipeline.
Local state files on ephemeral Cloud Build runners cause concurrency conflicts and state corruption risks.
Centralizing Infrastructure as Code state in Cloud Storage with native state locking guarantees atomic updates across concurrent pipeline executions.
2
Evaluate the service account IAM permissions.
Granting `roles/iam.serviceAccountAdmin` violates least-privilege security mandates.
Resources only require `roles/iam.serviceAccountUser` to attach or run under a service account, avoiding unnecessary identity administration capabilities.

Key Concept

CI/CD Pipeline Security and Remote State Governance
Rate this question

Topics

Analyzing Software Development Lifecycle (SDLC) and CI/CD Pipelines