Examkin

Question

Difficulty: HardAdvising Development and Operation Teams

A central platform engineering team is establishing automated infrastructure management and software deployment patterns across multiple Google Cloud projects. The team currently relies on long-lived service account JSON keys exported to external CI/CD pipelines, stores Terraform state files locally on runner build agents, and grants broad administrative permissions to prevent pipeline failures during resource creation. You are advising the development and operations teams on how to re-architect their deployment pipeline workflow to adhere to Google Cloud security and operational best practices while enforcing least privilege and preventing state corruption. Which TWO recommendations should you provide?

  1. Configure Workload Identity Federation for the external CI/CD pipeline to authenticate to Google Cloud using short-lived tokens instead of service account keys.Answer
  2. Migrate Terraform state files to a Cloud Storage backend with object versioning and state locking enabled using Cloud Spanner or Cloud Storage native locks.Answer
  3. C
    Grant the CI/CD pipeline service account the Project Owner primitive role at the GCP Organization root level so that upcoming infrastructure expansions do not fail due to missing IAM permissions.
  4. D
    Commit Terraform state files into the application's version-controlled Git repository alongside code commits so that developers can track infrastructure changes during pull requests.
  5. E
    Assign developers the Service Account Admin role so they can generate and download local service account keys whenever pipeline execution fails.

Answer

The correct recommendations are configuring Workload Identity Federation for external CI/CD pipelines to eliminate service account JSON keys, and migrating Terraform state management to a Cloud Storage remote backend with versioning and state locking.
Configuring Workload Identity Federation replaces vulnerable long-lived service account JSON keys with short-lived, auto-expiring OIDC credentials for external pipelines. Moving Terraform state to a remote Cloud Storage bucket with object versioning and state locking prevents concurrent pipeline runs from corrupting infrastructure state and ensures state history is safely maintained.

Step-by-Step Solution

1
Analyze authentication requirements for external operations tools.
Identify that exporting and storing service account JSON keys in external CI/CD tools creates a security liability. Using Workload Identity Federation allows short-lived token exchange via OIDC.
Google Cloud security best practices explicitly recommend eliminating long-lived service account keys in favor of federated identities.
2
Evaluate Infrastructure as Code state management strategy.
Determine that local or git-based state files lead to concurrency conflicts, corruption, and secret exposure. Cloud Storage backends provide native encryption, state locking, and object versioning.
Centralized, locked remote state backends guarantee reliable and safe concurrent IaC executions across dev and ops teams.
3
Assess IAM permissions and role assignment practices.
Reject broad primitive roles (such as Project Owner) and administrative service account roles in favor of fine-grained predefined or custom roles mapped to specific deployment actions.
Adhering to least privilege reduces the blast radius of compromised deployment credentials.

Key Concept

Advising Development and Operation Teams on Secure CI/CD Automation and IaC State Governance
Rate this question

Topics

Advising Development and Operation Teams

More questions from this topic