Examkin

Question

Difficulty: MediumAssessing and Mitigating Technical Debt in Cloud Architectures

A fintech enterprise specializing in real-time transaction reconciliation recently completed a technical debt assessment of its Google Cloud environment following an expedited cloud migration. The audit identified two critical architecture issues: infrastructure deployment state files are stored locally on developer workstations, and the CI/CD deployment service account is assigned the primitive Project Owner role to simplify deployment permissions. Which strategy best mitigates these technical debt findings in accordance with Google Cloud recommended practices?

  1. Migrate the infrastructure state to a central Cloud Storage bucket configured with object versioning and state locking, and replace the primitive Owner role with fine-grained predefined roles enforcing least privilege on the deployment service account.Answer
  2. B
    Store the local Infrastructure as Code (IaC) state files inside a private Git source control repository alongside application code, and assign the Service Account Admin role to the deployment service account.
  3. C
    Migrate state management to a Cloud Storage backend, but retain the primitive Project Owner role on the deployment service account to ensure CI/CD pipeline agility and avoid deployment authorization errors.
  4. D
    Deploy a dedicated, multi-zone Google Kubernetes Engine (GKE) cluster specifically to run custom operator pods for managing Terraform state and infrastructure provisioners, while keeping existing project permissions unchanged.

Answer

Migrate the infrastructure state to a central Cloud Storage bucket configured with object versioning and state locking, and replace the primitive Owner role with fine-grained predefined roles enforcing least privilege on the deployment service account.
The correct strategy addresses both technical debt findings directly using native Google Cloud best practices: storing IaC state in Cloud Storage provides encrypted, locking, and versioned state storage, while replacing primitive roles with fine-grained predefined roles restores least-privilege security controls.

Step-by-Step Solution

1
Assess IaC state management technical debt
Identified that local state storage creates risks of configuration drift, concurrent write collisions, and loss of state history.
Google Cloud recommends Cloud Storage with state locking and object versioning for secure, multi-user IaC deployment.
2
Assess IAM security technical debt
Identified that granting primitive Owner roles to service accounts creates severe security risks.
Least privilege mandates using specific predefined or custom roles tailored only to required resource actions.
3
Synthesize optimal mitigation strategy
Combine Cloud Storage state backend implementation with targeted IAM role assignment.
This directly remediates both identified architectural anti-patterns using standard, cost-effective GCP capabilities.

Key Concept

Mitigating Technical Debt in Cloud Security and Infrastructure Automation
Rate this question

Topics

Assessing and Mitigating Technical Debt in Cloud Architectures