Examkin

Question

Difficulty: MediumAdvising Development and Operation Teams

A mobile gaming platform team is advising feature development teams on standardizing automated CI/CD deployment pipelines and Infrastructure as Code (IaC) practices on Google Cloud. The feature teams run workflows via GitHub Actions and manage GCP resources using Terraform. The architect must recommend a configuration that strictly adheres to Google Cloud security best practices by eliminating long-lived credentials and preventing state file corruption. Which TWO architectural recommendations should the platform team provide? (Select TWO.)

  1. Configure Workload Identity Federation to allow GitHub Actions workflows to authenticate to Google Cloud using short-lived OIDC tokens instead of exported service account keys.Answer
  2. Store Terraform state files in a Google Cloud Storage bucket configured with Object Versioning enabled and uniform bucket-level access.Answer
  3. C
    Export service account JSON keys into GitHub Secrets and assign the primitive Owner role to the pipeline service account to avoid deployment permission errors.
  4. D
    Grant deployment developers the Service Account Admin role so they can impersonate and attach pipeline service accounts to arbitrary compute resources.
  5. E
    Maintain Terraform state files in local disk storage on GitHub runner instances and commit state file snapshots directly into the application Git repository.

Answer

The platform team should advise using Workload Identity Federation for keyless authentication from GitHub Actions and leveraging Cloud Storage with Object Versioning as the remote backend for Terraform state files.
Advising teams on GCP implementation requires promoting keyless authentication and remote IaC state governance. Workload Identity Federation allows GitHub Actions runners to exchange OIDC tokens for short-lived GCP credentials without downloading service account JSON keys. Storing Terraform state in a Cloud Storage bucket with Object Versioning guarantees centralized state locking, concurrency safety, and point-in-time recovery.

Step-by-Step Solution

1
Evaluate authentication strategy for external CI/CD pipelines
Workload Identity Federation provides keyless authentication using short-lived tokens, eliminating service account key management overhead and risk.
Security best practices require eliminating long-lived service account JSON keys.
2
Evaluate remote state management for Infrastructure as Code
Cloud Storage backends provide state locking and Object Versioning to safeguard IaC state across team deployments.
Local or Git-based state storage introduces concurrency conflicts and state file exposure.

Key Concept

Advising Development and Operation Teams on Keyless Authentication and IaC State Governance
Rate this question

Topics

Advising Development and Operation Teams

More questions from this topic