Examkin

Soru

Zorluk: OrtaAdvising Development and Operation Teams

A financial analytics firm's platform operations team is standardizing their infrastructure provisioning workflow. Currently, engineers create static JSON service account keys locally and use them with Terraform to deploy resources, frequently relying on the project Editor role to avoid permission issues. You are advising the team on establishing secure, automated Infrastructure as Code (IaC) practices that align with Google Cloud best practices while minimizing operational overhead. Which architectural recommendation should you provide?

  1. Configure Workload Identity Federation to authenticate CI/CD pipelines short-lived tokens without service account keys, store Terraform state in a Cloud Storage backend with object versioning, and grant the deployment service account fine-grained predefined roles.Cevap
  2. B
    Generate long-lived JSON service account keys stored in a secret manager, grant the deployment service account the Project Owner primitive role to ensure seamless provisioning, and keep the Terraform state file stored locally on developer machines.
  3. C
    Authenticate CI/CD pipelines using Workload Identity Federation, grant the deployment service account the Service Account Admin role across the organization, and store state files in a non-versioned Cloud Storage bucket.
  4. D
    Require developers to run gcloud auth application-default login using their personal user accounts assigned the Project Editor primitive role, committing the generated Terraform state file directly into the application git repository.

Cevap

Configure Workload Identity Federation to authenticate CI/CD pipelines with short-lived tokens, store Terraform state in a Cloud Storage backend with object versioning enabled, and grant the deployment service account granular predefined roles.
Advising dev/ops teams on GCP deployment automation requires enforcing keyless authentication via Workload Identity Federation, implementing reliable remote IaC state management in Cloud Storage with object versioning, and using fine-grained predefined IAM roles to satisfy the principle of least privilege.

Adım Adım Çözüm

1
Evaluate authentication and credential management requirements
Replace static, long-lived JSON service account key downloads with short-lived keyless authentication using Workload Identity Federation for external CI/CD runners.
Eliminates security risks associated with leaked or unrotated credentials.
2
Determine proper Infrastructure as Code state management
Configure a remote Google Cloud Storage (GCS) backend with state locking and object versioning.
Prevents state file corruption, enables multi-developer concurrency, and allows state rollback if needed.
3
Apply access control governance according to least privilege
Grant specific predefined roles (such as Compute Admin or Storage Admin) required for provisioning instead of primitive roles like Editor or Owner.
Restricts deployment permissions strictly to necessary resources and operations.

Anahtar Kavram

Advising Development and Operation Teams on Secure IaC Practices
Bu soruyu puanla

Konular

Advising Development and Operation Teams

Bu konudan daha fazla soru