Examkin

Soru

Zorluk: OrtaImplementing Infrastructure as Code using Terraform and Deployment Manager

An enterprise architecture team is configuring an automated CI/CD pipeline using Cloud Build and Terraform to provision resources across target Google Cloud projects. The team must adhere to Google Cloud security best practices by applying the principle of least privilege to the pipeline service account while ensuring concurrency safety and state integrity during automated deployments. Which provisioning strategy should the team implement?

  1. Assign fine-grained predefined IAM roles for target services and the Service Account User role to the Cloud Build service account, while configuring a remote Cloud Storage backend with object versioning and state locking enabled.Cevap
  2. B
    Assign the primitive Owner role at the organization level to the Cloud Build service account to prevent permission failures during provisioning, while storing state locally within the ephemeral build execution environment.
  3. C
    Assign the Service Account Admin role to the Cloud Build service account to allow attached compute resources to execute tasks, while configuring a remote Cloud Storage backend without object versioning.
  4. D
    Generate static service account JSON keys and embed them within the Terraform provider configuration, while disabling state locking to increase parallel execution speed.

Cevap

Assign fine-grained predefined IAM roles for target services and the Service Account User role to the Cloud Build service account, while configuring a remote Cloud Storage backend with object versioning and state locking enabled.
The correct strategy enforces the principle of least privilege by combining fine-grained predefined target roles with the Service Account User role for service account impersonation. Additionally, configuring a Google Cloud Storage remote backend with versioning and object locking guarantees state file resilience and prevents concurrent pipelines from corrupting infrastructure state.

Adım Adım Çözüm

1
Evaluate the IAM permission requirements for the deployment pipeline service account.
Identified that least privilege requires granting specific predefined roles for managed resources and roles/iam.serviceAccountUser to attach service accounts to compute resources, rather than broad administrative or primitive roles.
Prevents over-privileging the CI/CD pipeline while granting necessary execution rights.
2
Evaluate the state management architecture for automated Terraform executions.
Selected Cloud Storage as a remote backend with object versioning and state locking enabled via Cloud Storage object locking.
Ensures state consistency, enables concurrency controls during pipeline execution, and provides rollback capabilities via bucket object versioning.

Anahtar Kavram

Secure IaC automation using least-privilege service accounts and centralized Cloud Storage backend with state locking.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Implementing Infrastructure as Code using Terraform and Deployment Manager

Bu konudan daha fazla soru