Examkin

Soru

Zorluk: OrtaProvisioning Compute Engine and Kubernetes Engine Clusters

A financial technology firm is automating the provisioning of a private Google Kubernetes Engine (GKE) cluster using Terraform for an isolated transaction processing engine. Operational security guidelines require restricting network access to the GKE control plane strictly to designated internal administrative subnets, protecting infrastructure state from concurrent modification or corruption, and following least-privilege IAM practices when enabling CI/CD pipelines to attach identities to cluster node pools. Which design choices should the cloud architect include in the deployment configuration? (Select TWO.)

  1. Enable Control Plane Authorized Networks on the cluster and restrict master endpoint access to authorized internal subnet CIDR blocks.Cevap
  2. Configure a Cloud Storage bucket with object versioning and state locking enabled as the remote backend for Terraform state.Cevap
  3. C
    Grant the Service Account Admin role (`roles/iam.serviceAccountAdmin`) to the deployment pipeline service account to permit provisioning node pools with custom identities.
  4. D
    Store the Terraform state file in unversioned local storage on the deployment pipeline runner to optimize execution performance.
  5. E
    Rely on standard IAM primitive roles assigned to administrators rather than enabling Control Plane Authorized Networks on the cluster.

Cevap

The correct design choices are enabling Control Plane Authorized Networks with specific internal CIDR ranges and configuring a Cloud Storage remote backend with versioning and state locking for Terraform state management.
Enabling Control Plane Authorized Networks restricts administrative traffic to specific CIDR ranges, establishing network perimeter security for the private master endpoint. Storing Terraform state in Cloud Storage with versioning and state locking provides essential concurrency protection and state consistency across deployment pipelines.

Adım Adım Çözüm

1
Analyze control plane access security requirements.
Enabling Control Plane Authorized Networks enforces IP-based perimeter filtering on the GKE master endpoint, permitting connections only from authorized internal subnet CIDR ranges.
IAM permissions govern identity authorization but do not restrict network-level routing to cluster endpoints.
2
Determine remote state storage practices for Infrastructure as Code automation.
Configuring a Cloud Storage remote backend with versioning and object locking ensures state integrity, auditability, and concurrency control for Terraform state.
Unversioned local storage exposes infrastructure deployments to state drift, loss, and race conditions.
3
Evaluate IAM role assignments for provisioning service accounts.
Assigning Service Account User (`roles/iam.serviceAccountUser`) allows deployment pipelines to bind service accounts to compute nodes, whereas Service Account Admin grants unnecessary management privileges.
Principle of least privilege dictates granting resource usage permissions rather than full administrative permissions.

Anahtar Kavram

Provisioning private GKE clusters securely requires enforcing Control Plane Authorized Networks, applying least-privilege IAM roles (`roles/iam.serviceAccountUser`), and managing Infrastructure as Code state using remote locked backends.
Bu soruyu puanla

Konular

Provisioning Compute Engine and Kubernetes Engine Clusters

Bu konudan daha fazla soru