Examkin

Question

Difficulty: Very hardAssessing and Mitigating Technical Debt in Cloud Architectures

A global media organization recently completed a rapid cloud migration to Google Cloud, resulting in accrued technical debt across their operations. An architectural audit revealed two critical anti-patterns: infrastructure deployment engineers manage environment changes by executing automated Terraform scripts locally using unversioned state files, leading to frequent state corruption; additionally, application service accounts running stateless workloads on Compute Engine were assigned primitive Owner roles to circumvent deployment permission blockers. Which TWO mitigations should the Cloud Architect implement to resolve this technical debt while following Google Cloud recommended practices? (Select TWO answers.)

  1. Migrate Terraform state management to a centralized Google Cloud Storage backend configured with object versioning and state locking, and mandate execution via automated CI/CD pipelines.Answer
  2. Audit application permission usage to replace primitive Owner roles with least-privilege predefined or custom IAM roles attached directly to application service accounts.Answer
  3. C
    Grant the Service Account Admin role (roles/iam.serviceAccountAdmin) to the application service accounts so they can dynamically manage their own security bounds and credentials.
  4. D
    Re-platform all stateless Compute Engine virtual machines onto a multi-cluster Google Kubernetes Engine (GKE) Enterprise deployment to enforce state locking and cluster access control.

Answer

The Cloud Architect should centralize Terraform state management in a Cloud Storage remote backend with object versioning and state locking integrated into CI/CD pipelines, and replace primitive Owner roles on application service accounts with least-privilege predefined or custom IAM roles.
The correct mitigations address the core technical debt directly. Moving Terraform state management to a Cloud Storage remote backend with versioning and object locking ensures operational state consistency and enables automated pipeline deployments. Concurrently, auditing service account usage and replacing broad primitive Owner roles with minimal predefined or custom IAM roles establishes robust security governance without adding unnecessary infrastructure complexity.

Step-by-Step Solution

1
Analyze the technical debt identified in the infrastructure audit
Two distinct technical debt domains are present: operational IaC state management debt (local unversioned state) and security governance debt (primitive IAM Owner roles).
Resolving technical debt requires targeting root causes across operational governance and security identity architecture.
2
Evaluate IaC remediation options against GCP architecture standards
Migrating Terraform state to Cloud Storage remote backends with object versioning, object locking, and CI/CD automation solves state corruption and drift.
Remote state backends provide consistency, concurrency locking, and auditability for infrastructure as code.
3
Evaluate IAM governance remediation options against GCP security standards
Auditing active permissions and replacing primitive Owner roles with least-privilege predefined or custom roles mitigates unauthorized access risks.
Primitive roles grant excessive project-wide permissions that violate security compliance and principle of least privilege.

Key Concept

Mitigating Technical Debt in Infrastructure as Code and IAM Security Governance
Rate this question

Topics

Assessing and Mitigating Technical Debt in Cloud Architectures