Examkin

Question

Difficulty: HardProvisioning Compute Engine and Kubernetes Engine Clusters

A digital publishing platform is constructing an automated deployment pipeline using Infrastructure as Code (Terraform) to provision high-throughput compute infrastructure on Google Cloud. The architecture requires deploying a regional Managed Instance Group (MIG) of Compute Engine instances that will autoscale up to 500 N2 vCPUs during traffic bursts. The compute instances must execute using a dedicated workload service account with minimal privileges. Multiple DevOps engineers and automated CI/CD runners will execute Terraform deployments concurrently. Which provisioning design strategy should the Cloud Architect implement to meet these requirements securely and reliably?

  1. Configure a Cloud Storage backend with object versioning and state locking enabled, pre-emptively request a regional N2 vCPU quota increase, and grant the CI/CD pipeline service account the Service Account User role on the workload service account.Answer
  2. B
    Configure a Cloud Storage backend with object versioning and state locking enabled, pre-emptively request a regional N2 vCPU quota increase, and grant the CI/CD pipeline service account the Service Account Admin role on the workload service account.
  3. C
    Configure a Cloud Storage backend with object versioning and state locking enabled, rely on automatic dynamic quota adjustment during peak traffic deployment, and grant the CI/CD pipeline service account the Service Account User role on the workload service account.
  4. D
    Store the Terraform state file in a localized directory on the ephemeral CI/CD runner host, pre-emptively request a regional N2 vCPU quota increase, and grant the CI/CD pipeline service account the Service Account User role on the workload service account.

Answer

Configure a Cloud Storage backend with object versioning and state locking enabled, pre-emptively request a regional N2 vCPU quota increase, and grant the CI/CD pipeline service account the Service Account User role on the workload service account.
The correct option addresses all three critical requirements of enterprise compute provisioning: Cloud Storage remote backend with state locking prevents concurrent pipeline runs from corrupting IaC state; pre-emptively requesting regional vCPU quota increases prevents instance creation failures when the MIG autoscales up to 500 vCPUs; and assigning the Service Account User role allows the deployment pipeline to provision instances under the workload service account without granting excessive security permissions.

Step-by-Step Solution

1
Evaluate IaC state storage requirements for team and automated CI/CD concurrency.
Identify that Cloud Storage remote backends with object versioning and state locking (via Cloud Storage native locking) prevent state corruption and race conditions.
Local or unversioned state storage leads to concurrency conflicts and lost infrastructure state.
2
Assess compute provisioning quota limits for scaling workloads.
Determine that scaling to 500 N2 vCPUs requires verifying existing regional quotas and requesting an increase prior to deployment.
Default GCP regional compute quotas will block autoscaling MIG instance creation if not raised beforehand.
3
Determine the minimal IAM permissions needed for a deployment pipeline to attach a custom service account to compute instances.
Select the Service Account User role (roles/iam.serviceAccountUser).
This role allows the pipeline to impersonate or bind the service account to resources without granting administrative permissions over the service account itself.

Key Concept

Compute Resource Provisioning, Quotas, IaC State Management, and Service Account Security
Rate this question

Topics

Provisioning Compute Engine and Kubernetes Engine Clusters

More questions from this topic