Examkin

Question

Difficulty: HardBuilding and Managing Infrastructure as Code (IaC)

An automated trading platform engineering team is establishing an Infrastructure as Code (IaC) deployment pipeline for Google Cloud workloads across development, staging, and production environments using Terraform and Cloud Build. The security policy mandates least privilege execution, environment isolation, protection against concurrent state modifications, and strict state version auditability. Which deployment architecture should the cloud architect recommend?

  1. Provision dedicated Cloud Storage buckets per environment with Object Versioning enabled for remote backends, enforce state locking via Cloud Storage native locking mechanisms, and configure Cloud Build pipelines to impersonate environment-specific service accounts granted minimal predefined IAM roles.Answer
  2. B
    Store state files locally within ephemeral Cloud Build execution containers during pipeline execution, and grant developers project Owner roles so they can manually fix resource provisioning errors via the Cloud Console if an apply step fails.
  3. C
    Use a single shared Cloud Storage bucket across all environments without Object Versioning or locking to simplify pipeline configuration, and execute Cloud Build pipelines using the default Project Editor role to avoid IAM permissions errors.
  4. D
    Configure Terraform to maintain state in an unversioned single Cloud Storage bucket while allowing parallel pipeline steps to run without state locks to minimize CI/CD build execution time.

Answer

Provision dedicated Cloud Storage buckets per environment with Object Versioning enabled for remote backends, enforce state locking via Cloud Storage native locking mechanisms, and configure Cloud Build pipelines to impersonate environment-specific service accounts granted minimal predefined IAM roles.
The correct approach enforces enterprise-grade Infrastructure as Code governance by isolating Terraform remote state backends into separate Cloud Storage buckets per environment, enabling state locking and object versioning to protect against state corruption, and scoping CI/CD pipeline access using dedicated service accounts with fine-grained predefined roles.

Step-by-Step Solution

1
Isolate remote state storage across environment boundaries
Separate Cloud Storage buckets per environment prevent accidental cross-environment modifications.
Production and lower environments must be isolated at both resource and state management layers.
2
Enable Object Versioning and native locking on state backends
State locking prevents concurrent pipeline runs from corrupting state, while versioning enables state recovery.
Terraform relies on state consistency; versioning provides disaster recovery for state corruption.
3
Scope CI/CD execution identity with short-lived impersonation and minimal IAM roles
Cloud Build impersonates fine-grained service accounts without exposing static long-lived keys or over-privileged primitive roles.
Adheres to security least-privilege principles.

Key Concept

Enterprise IaC Governance with Terraform, Remote State Security, and Least Privilege CI/CD Execution
Estimated Time:2m 0s
Rate this question

Topics

Building and Managing Infrastructure as Code (IaC)

More questions from this topic