Examkin

Question

Difficulty: MediumAnalyzing Software Development Lifecycle (SDLC) and CI/CD Pipelines

An online interactive media enterprise is analyzing its continuous integration and continuous delivery (CI/CD) software development lifecycle (SDLC) pipeline. The pipeline uses Cloud Build to execute Terraform configurations that provision application infrastructure across Google Cloud projects. A technical audit reveals security and operational vulnerabilities in how the pipeline executes build steps and manages deployment state. Which architectural recommendation should the Cloud Architect make to align the CI/CD pipeline with Google Cloud security and reliability best practices?

  1. Attach a dedicated custom service account with minimal required predefined roles to the Cloud Build trigger, and store the Terraform state in a Cloud Storage bucket with object versioning and state locking enabled.Answer
  2. B
    Grant the primitive Owner role to the default Cloud Build service account to prevent permission errors during deployment, and store the Terraform state in a standard Cloud Storage bucket without versioning.
  3. C
    Grant the Service Account Admin role to the pipeline service account so it can manage compute instances and service account keys, while storing state files in local workspace storage.
  4. D
    Maintain the Terraform state file on the ephemeral local disk of the Cloud Build worker instance to minimize build latency and rely solely on standard IAM to prevent exfiltration.

Answer

Attach a dedicated custom service account with minimal required predefined roles to the Cloud Build trigger, and store the Terraform state in a Cloud Storage bucket with object versioning and state locking enabled.
Configuring Cloud Build to execute using a dedicated custom service account with granular, least-privilege predefined roles reduces the blast radius of build execution. Pairing this with a remote Cloud Storage backend configured with object versioning and state locking guarantees concurrent execution protection, state persistence, and disaster recovery for Infrastructure as Code.

Step-by-Step Solution

1
Analyze CI/CD security requirements for Cloud Build execution.
Identify that using a dedicated custom service account with fine-grained predefined roles enforces least privilege, replacing default high-privilege accounts.
Default or primitive roles expose the entire cloud environment to privilege escalation if build scripts are compromised.
2
Analyze Infrastructure as Code (IaC) state management best practices for pipeline-driven Terraform deployments.
Determine that remote backend storage in Cloud Storage with state locking and object versioning is required.
Remote state in Cloud Storage prevents state corruption, enables concurrent lock management, and versioning allows state recovery.

Key Concept

CI/CD Pipeline Security and Infrastructure as Code State Management
Estimated Time:1m 30s
Rate this question

Topics

Analyzing Software Development Lifecycle (SDLC) and CI/CD Pipelines