Examkin

Question

Difficulty: MediumImplementing Infrastructure as Code using Terraform and Deployment Manager

An organization is designing a multi-environment infrastructure deployment strategy on Google Cloud using Terraform. They need to establish environment isolation between staging and production while ensuring state file integrity and maintaining least-privilege administrative access. Which TWO architectural and operational practices should the team implement to satisfy these requirements? (Select TWO)

  1. Configure isolated Cloud Storage buckets with Object Versioning enabled for each environment's remote Terraform backend.Answer
  2. Grant dedicated pipeline service accounts fine-grained predefined IAM roles specific to each environment rather than primitive roles.Answer
  3. C
    Grant the deployment service account the primitive Owner role (roles/owner) across all projects to streamline access management.
  4. D
    Store state files for all environments in a single local unversioned directory on the CI/CD runner to minimize storage latency.

Answer

The team should configure isolated Cloud Storage buckets with Object Versioning enabled for each environment's remote backend and assign fine-grained predefined IAM roles to dedicated pipeline service accounts.
Isolating Terraform remote backends into environment-specific Cloud Storage buckets with Object Versioning guarantees state protection, concurrency locking via Cloud Storage, and environment isolation. Furthermore, assigning fine-grained predefined IAM roles to dedicated environment service accounts enforces least privilege.

Step-by-Step Solution

1
Evaluate Terraform backend security and isolation requirements.
Identify that separate Cloud Storage buckets per environment with Object Versioning provide state isolation, locking, and recovery capabilities.
Prevent accidental state overwrites between staging and production and allow rollback if state corruption occurs.
2
Evaluate IAM privileges for automated deployment execution.
Determine that service accounts should use least-privilege predefined or custom IAM roles mapped specifically to target environments.
Avoid security exposure associated with broad primitive roles like Owner.

Key Concept

Infrastructure as Code environment isolation, remote state management with Cloud Storage, and least-privilege IAM configuration.
Estimated Time:1m 30s
Rate this question

Topics

Implementing Infrastructure as Code using Terraform and Deployment Manager

More questions from this topic