Examkin

Soru

Zorluk: OrtaImplementing Infrastructure as Code using Terraform and Deployment Manager

An enterprise organization is deploying core cloud infrastructure to Google Cloud using Terraform. Multiple cloud engineers perform concurrent deployments across automated CI/CD pipelines and local workstations. The lead architect must ensure that Terraform state files are securely protected against corruption, support state locking during concurrent execution, retain historical state versions for disaster recovery, and follow GCP least-privilege security principles. Which architecture configuration should the team implement?

  1. Configure a Cloud Storage (GCS) backend in Terraform with object versioning enabled, using Cloud IAM fine-grained roles for service account access control.Cevap
  2. B
    Store the Terraform state files in a local directory synchronized to a shared Git repository, ensuring engineers commit state changes after each deployment.
  3. C
    Store Terraform state in a GCS bucket and assign the primitive Owner role (roles/owner) to the deployment service account to guarantee complete execution access across state locks.
  4. D
    Maintain state files on compute instances and manually resolve resource conflict states by modifying resource configurations directly within the GCP Console prior to running Terraform apply.

Cevap

Configure a Cloud Storage (GCS) backend in Terraform with object versioning enabled, using Cloud IAM fine-grained roles for service account access control.
Configuring a Cloud Storage (GCS) bucket as the remote backend for Terraform inherently provides atomic state locking and consistency. Enabling object versioning ensures state history retention for rollback or recovery, while applying granular IAM roles enforces security best practices.

Adım Adım Çözüm

1
Identify the storage requirement for remote state management and concurrency protection.
Cloud Storage (GCS) provides a centralized remote backend for Terraform state.
Remote state centralization prevents isolated, conflicting local state files among team members.
2
Enable object versioning on the Cloud Storage bucket and verify state locking capabilities.
GCS natively supports state locking and holds full version history for state recovery.
State locking prevents concurrent executions from mutating state simultaneously, while versioning allows recovery from corrupted state runs.
3
Apply Google Cloud IAM least-privilege access controls.
Service accounts access the GCS state bucket via minimal predefined storage roles (such as Storage Object Admin on the specific state bucket).
Avoids granting excessive project-level primitive roles like Owner or Editor.

Anahtar Kavram

Terraform Remote Backend and State Management Best Practices on GCP
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Implementing Infrastructure as Code using Terraform and Deployment Manager

Bu konudan daha fazla soru