Examkin

Question

Difficulty: Very hardProvisioning Compute Engine and Kubernetes Engine Clusters

An enterprise data analytics platform is building an automated Infrastructure as Code (IaC) deployment pipeline using Terraform to provision Compute Engine instance groups and Kubernetes Engine (GKE) node pools across multiple projects. The pipeline is executed by an automated CI/CD service account. The solution must ensure state file integrity, prevent race conditions during parallel team deployments, prevent operational failures during sudden cluster scale-outs, and strictly follow the principle of least privilege for service account impersonation. Which TWO architectural practices should the cloud architect mandate?

  1. Configure the Terraform remote backend using a Google Cloud Storage bucket with Object Versioning enabled for state persistence and native locking.Answer
  2. Submit regional quota increase requests for Compute Engine CPU cores and node pool resources prior to initiating automated large-scale provisioning.Answer
  3. C
    Store the Terraform state file locally within the CI/CD runner container storage layer to minimize remote storage API latency.
  4. D
    Assign the primitive Owner role (`roles/owner`) to the compute instance service account to guarantee API access across all project resources.
  5. E
    Grant the CI/CD pipeline service account the Service Account Admin role (`roles/iam.serviceAccountAdmin`) on the target project to allow resource attachment.

Answer

The correct practices are configuring a Cloud Storage remote backend with Object Versioning for Terraform state locking and requesting regional quota increases in advance before large-scale compute provisioning.
Centralizing Terraform state in a Cloud Storage bucket with Object Versioning and native locking prevents state corruption and concurrent state modifications. Additionally, requesting regional CPU and compute resource quota increases in advance ensures automated deployment scripts do not fail due to GCP quota limits during rapid cluster scale-outs.

Step-by-Step Solution

1
Evaluate IaC state safety requirements.
Local state storage in ephemeral CI/CD environments causes state corruption and concurrency locks. Utilizing a GCS remote backend with Object Versioning provides central state persistence and state locking.
Safe team-based infrastructure provisioning requires centralized, versioned, and locked state management.
2
Evaluate resource capacity and quota constraints.
Automated deployments of large Compute Engine and GKE clusters frequently breach default regional quotas if not anticipated.
Requesting regional quota increases in advance guarantees that automated provisioning jobs complete cleanly without resource exhaustion errors.
3
Review security options against least privilege guidelines.
Primitive roles (`roles/owner`) and administrative permissions (`roles/iam.serviceAccountAdmin`) exceed required permissions for provisioning and operating compute workloads.
Workload service accounts should use granular predefined roles, and deployment service accounts require `roles/iam.serviceAccountUser` to attach service accounts to instances.

Key Concept

Provisioning automated compute infrastructure requires safe state backend management, proactive quota planning, and strict IAM least-privilege scoping.
Rate this question

Topics

Provisioning Compute Engine and Kubernetes Engine Clusters

More questions from this topic