Examkin

Question

Difficulty: HardProvisioning Compute Engine and Kubernetes Engine Clusters

A retail enterprise is standardizing its cloud deployment framework on Google Cloud. The infrastructure architecture requires deploying new GKE clusters alongside Compute Engine Managed Instance Groups (MIGs) via an automated Infrastructure as Code (IaC) CI/CD pipeline. The security and operations policy dictates strict access controls to cluster control planes, least-privilege identity delegation for deployment workers, and prevention of concurrent deployment state corruption across 1515 distinct feature teams. Which THREE configuration standards should the architecture team enforce in their provisioning blueprint? (Select 3 choices)

  1. Provision GKE clusters as Private Clusters and configure Control Plane Authorized Networks restricted exclusively to management subnet CIDR ranges.Answer
  2. Grant the deployment pipeline service account the Service Account User role (roles/iam.serviceAccountUser) on the specific compute runtime service accounts.Answer
  3. Store Terraform infrastructure state in a remote Cloud Storage backend configured with Object Versioning and state locking.Answer
  4. D
    Assign the primitive Editor role (roles/editor) to the automated deployment pipeline service account at the GCP project level to ensure seamless provisioning of new resource types.
  5. E
    Deploy single-container, low-frequency configuration synchronization scripts onto dedicated multi-zone GKE clusters to simplify environment lifecycle management.

Answer

The correct architectural choices are: (1) Provisioning GKE clusters as Private Clusters with Control Plane Authorized Networks configured to restrict access to trusted internal IP ranges, (2) Assigning the Service Account User role to the deployment pipeline service account on runtime identities, and (3) Storing Terraform state in a remote Cloud Storage backend with Object Versioning and state locking enabled.
The solution requires a secure, automated, and maintainable compute provisioning architecture. Private GKE clusters with Control Plane Authorized Networks secure the Kubernetes control plane from unauthorized network access. Assigning `roles/iam.serviceAccountUser` provides the automated pipeline with exact privileges needed to run resources under specified runtime identities without administrative over-privilege. Using a Cloud Storage backend with state locking and Object Versioning ensures safe multi-team IaC collaboration.

Step-by-Step Solution

1
Analyze Kubernetes Engine cluster control plane exposure requirements.
GKE Private Clusters keep worker node IP addresses non-routable over the public internet, and Control Plane Authorized Networks restrict master endpoint communication to specified internal management CIDR ranges.
This satisfies corporate security mandates to prevent untrusted access to Kubernetes API endpoints.
2
Evaluate IAM privilege bounds for automated deployment infrastructure.
Deployment service accounts require permission to bind runtime service accounts to Compute Engine instances or GKE node pools, which is granted via `roles/iam.serviceAccountUser`.
Granting `roles/iam.serviceAccountUser` follows least privilege, whereas granting primitive roles like Editor or Service Account Admin creates severe privilege escalation vectors.
3
Select state management and concurrency controls for multi-team IaC provisioning.
A central Cloud Storage backend with native state locking and versioning prevents concurrent state writes and allows state restoration.
Preventing simultaneous pipeline runs from writing to local unversioned state files eliminates state corruption across 1515 feature teams.

Key Concept

Enterprise provisioning standards for GKE cluster security, IAM service account user delegation, and Terraform remote state lock management.
Rate this question

Topics

Provisioning Compute Engine and Kubernetes Engine Clusters

More questions from this topic