Examkin

Question

Difficulty: HardBuilding and Managing Infrastructure as Code (IaC)

An enterprise biotechnology organization is designing an automated continuous delivery pipeline to manage infrastructure across multiple Google Cloud projects using Terraform. The pipeline must guarantee secure remote state persistence, prevent state file corruption during concurrent deployment execution, eliminate long-lived service account authentication keys, and maintain strict identity least privilege. Which TWO actions should the cloud architecture team implement to satisfy these requirements? (Select TWO.)

  1. Configure a Google Cloud Storage backend with Object Versioning enabled for remote Terraform state storage and state locking.Answer
  2. B
    Store state files locally within ephemeral build runners and upload unversioned copies to Cloud Storage after execution.
  3. Authenticate the external deployment runner using Workload Identity Federation to impersonate a dedicated service account with fine-grained IAM roles.Answer
  4. D
    Grant the Owner primitive role to the CI/CD service account to prevent deployment pipeline failures across GCP services.
  5. E
    Perform manual resource updates directly via Google Cloud Console whenever urgent deployment lock issues arise in production.

Answer

The architecture team should store remote Terraform state in a Google Cloud Storage bucket with Object Versioning enabled to ensure state resilience and concurrency control, and authenticate external deployment pipelines using Workload Identity Federation to eliminate long-lived service account keys while enforcing least privilege through fine-grained IAM roles.
Configuring Cloud Storage with Object Versioning provides secure, centralized, and version-controlled remote state persistence that automatically handles locking to prevent concurrent state modifications. Pairing this backend with Workload Identity Federation allows external CI/CD systems to securely assume dedicated GCP service account identities using short-lived tokens, adhering strictly to least-privilege access without exporting static credential files.

Step-by-Step Solution

1
Evaluate remote backend state lock and durability requirements
Selected Cloud Storage with Object Versioning to store Terraform state securely with locking and version history.
Google Cloud Storage backends provide native file locking mechanisms to prevent concurrent state access and maintain version history against corruption.
2
Assess pipeline authentication security and key management constraints
Selected Workload Identity Federation for external CI/CD pipeline access.
Workload Identity Federation enables short-lived identity exchange for service account impersonation without creating long-lived exported JSON keys.
3
Verify adherence to least privilege security rules
Scoped service account access to predefined granular roles rather than broad primitive roles.
Primitive roles like Owner grant excessive broad permissions and break enterprise GCP compliance standards.

Key Concept

Infrastructure as Code Governance, State Backend Lock Security, and Pipeline Identity Scoping
Rate this question

Topics

Building and Managing Infrastructure as Code (IaC)

More questions from this topic