Examkin

Question

Difficulty: HardBuilding and Managing Infrastructure as Code (IaC)

An enterprise gaming studio manages its multi-region multiplayer backend infrastructure using Terraform across multiple Google Cloud projects. The cloud architecture team needs to establish a secure Infrastructure as Code (IaC) governance model. The model must prevent concurrent deployment state corruption, eliminate security risks associated with exporting service account keys, and ensure any manual out-of-band infrastructure changes are rapidly identified. Which TWO actions should the lead architect mandate to achieve these requirements?

  1. Configure a Google Cloud Storage (GCS) remote backend with object versioning enabled, and authenticate the CI/CD pipeline using Workload Identity Federation with fine-grained predefined roles.Answer
  2. Schedule continuous execution of terraform plan in the CI/CD pipeline to detect configuration drift against real-world infrastructure and require all environment updates to occur exclusively through pull-request pipelines.Answer
  3. C
    Commit Terraform state (.tfstate) files directly to a private Git repository so developers can track infrastructure changes using standard Git commit histories.
  4. D
    Grant the primitive roles/owner role to the deployment service account to ensure pipeline jobs do not fail due to missing resource permissions during multi-project provisionings.
  5. E
    Permit operators to perform manual updates via the Google Cloud Console during emergency incidents, provided they manually adjust local resource configuration files afterwards.

Answer

The team should configure a Google Cloud Storage remote backend with versioning and Workload Identity Federation for keyless authentication, and schedule automated terraform plan runs to continuously detect out-of-band configuration drift.
Configuring a Cloud Storage remote backend ensures automated state locking and versioning protection, while Workload Identity Federation eliminates exported long-lived service account keys. Coupling this with automated scheduled terraform plan pipelines guarantees early drift detection and enforces IaC as the single source of truth.

Step-by-Step Solution

1
Configure backend state management and keyless CI/CD authentication
Cloud Storage remote backend provides native state locking and state versioning, while Workload Identity Federation avoids storing long-lived service account keys in CI/CD platforms.
Eliminates state corruption from concurrent applies while establishing secure least-privilege authentication.
2
Implement automated pipeline-driven drift detection and enforcement
Running scheduled terraform plan operations alerts the team when live infrastructure diverges from defined HCL code.
Ensures out-of-band modifications are immediately flagged and prevents manual changes from breaking future deployments.

Key Concept

Building and Managing Infrastructure as Code (IaC) governance with remote state management, least privilege CI/CD security, and automated drift detection.
Rate this question

Topics

Building and Managing Infrastructure as Code (IaC)

More questions from this topic