Examkin

Question

Difficulty: MediumAdvising Development and Operation Teams

A financial analytics firm's platform operations team is standardizing their infrastructure provisioning workflow. Currently, engineers create static JSON service account keys locally and use them with Terraform to deploy resources, frequently relying on the project Editor role to avoid permission issues. You are advising the team on establishing secure, automated Infrastructure as Code (IaC) practices that align with Google Cloud best practices while minimizing operational overhead. Which architectural recommendation should you provide?

  1. Configure Workload Identity Federation to authenticate CI/CD pipelines short-lived tokens without service account keys, store Terraform state in a Cloud Storage backend with object versioning, and grant the deployment service account fine-grained predefined roles.Answer
  2. B
    Generate long-lived JSON service account keys stored in a secret manager, grant the deployment service account the Project Owner primitive role to ensure seamless provisioning, and keep the Terraform state file stored locally on developer machines.
  3. C
    Authenticate CI/CD pipelines using Workload Identity Federation, grant the deployment service account the Service Account Admin role across the organization, and store state files in a non-versioned Cloud Storage bucket.
  4. D
    Require developers to run gcloud auth application-default login using their personal user accounts assigned the Project Editor primitive role, committing the generated Terraform state file directly into the application git repository.

Answer

Configure Workload Identity Federation to authenticate CI/CD pipelines with short-lived tokens, store Terraform state in a Cloud Storage backend with object versioning enabled, and grant the deployment service account granular predefined roles.
Advising dev/ops teams on GCP deployment automation requires enforcing keyless authentication via Workload Identity Federation, implementing reliable remote IaC state management in Cloud Storage with object versioning, and using fine-grained predefined IAM roles to satisfy the principle of least privilege.

Step-by-Step Solution

1
Evaluate authentication and credential management requirements
Replace static, long-lived JSON service account key downloads with short-lived keyless authentication using Workload Identity Federation for external CI/CD runners.
Eliminates security risks associated with leaked or unrotated credentials.
2
Determine proper Infrastructure as Code state management
Configure a remote Google Cloud Storage (GCS) backend with state locking and object versioning.
Prevents state file corruption, enables multi-developer concurrency, and allows state rollback if needed.
3
Apply access control governance according to least privilege
Grant specific predefined roles (such as Compute Admin or Storage Admin) required for provisioning instead of primitive roles like Editor or Owner.
Restricts deployment permissions strictly to necessary resources and operations.

Key Concept

Advising Development and Operation Teams on Secure IaC Practices
Rate this question

Topics

Advising Development and Operation Teams

More questions from this topic