Examkin

Question

Difficulty: HardAdvising Development and Operation Teams

An enterprise platform engineering team is preparing to automate application deployment pipelines using an external CI/CD system to provision infrastructure across Google Cloud projects using Terraform and deploy microservices to Google Kubernetes Engine (GKE). You are advising the development and operations teams on security, state management, and operational release procedures. The solution must adhere to the principle of least privilege, protect deployment integrity, and minimize operational overhead. Which TWO recommendations should you provide to meet these requirements?

  1. Configure Workload Identity Federation to authenticate external CI/CD pipeline runners using short-lived credentials, and grant the pipeline service account the Service Account User role (roles/iam.serviceAccountUser) only on specific deployment service accounts.Answer
  2. Store Terraform state files in a central Cloud Storage bucket with Object Versioning enabled and uniform bucket-level access enforced to manage infrastructure state safely.Answer
  3. C
    Assign the project-level Editor primitive role (roles/editor) to the CI/CD deployment service account to ensure all existing and future infrastructure provisioning tasks succeed without permission errors.
  4. D
    Maintain Terraform state files within the ephemeral CI/CD runner workspace and commit state file updates back into the version-controlled application source repository after every deployment.
  5. E
    Rely on automatic compute resource scaling during deployment without submitting regional quota increase requests prior to launching large-scale multi-region cluster deployments.

Answer

The correct recommendations are to configure Workload Identity Federation with fine-grained Service Account User permissions for external CI/CD runners, and to store Terraform state files in a Cloud Storage bucket configured with Object Versioning and uniform bucket-level access.
Configuring Workload Identity Federation allows external pipeline runners to authenticate securely without persistent service account keys, while restricting permissions to the Service Account User role on specific target accounts maintains least privilege. Additionally, using Cloud Storage with Object Versioning and uniform bucket-level access for Terraform remote state provides state locking, concurrency control, and resilience against state corruption.

Step-by-Step Solution

1
Evaluate authentication and credential management for external CI/CD pipelines.
Identify that long-lived service account keys present security risks, whereas Workload Identity Federation provides secure short-lived token exchange.
Eliminating static service account keys enforces cloud security best practices.
2
Evaluate identity and access permissions for deployment execution.
Determine that assigning roles/iam.serviceAccountUser scoped to specific workload service accounts follows least privilege, whereas primitive roles like Editor grant dangerous, excessive access.
Least privilege access prevents unauthorized modifications to surrounding infrastructure.
3
Evaluate Infrastructure as Code (IaC) state management strategy.
Determine that Cloud Storage backends supporting locking, Object Versioning, and uniform access prevent race conditions and state corruption, whereas git repository state storage introduces corruption and credential leakage risks.
Centralized remote backends with locking are required for reliable, collaborative Terraform execution.

Key Concept

Best practices for advising DevOps teams on GCP security integration, Workload Identity Federation, and secure Infrastructure as Code state management.
Estimated Time:2m 0s
Rate this question

Topics

Advising Development and Operation Teams

More questions from this topic