Examkin

Soru

Zorluk: ZorProvisioning Compute Engine and Kubernetes Engine Clusters

A logistics enterprise is deploying an automated CI/CD pipeline using Infrastructure as Code (IaC) with Terraform to provision regional Compute Engine Managed Instance Groups (MIGs) across multiple GCP projects. The design requirements mandate enforcing least-privilege access for deployment service accounts, maintaining Infrastructure as Code state integrity against concurrent execution conflicts, and preventing deployment failures during large-scale compute resource provisioning. Which architectural and provisioning practices should you incorporate into this solution? (Select THREE choices.)

  1. Configure the Terraform backend to use a Google Cloud Storage bucket with object versioning and state locking enabled.Cevap
  2. Grant the deployment service account the Service Account User role (roles/iam.serviceAccountUser) on the target workload service account.Cevap
  3. Verify and request regional Compute Engine CPU and instance quota increases prior to executing automated large-scale instance group provisioning.Cevap
  4. D
    Assign the primitive Editor IAM role to the default Compute Engine service account so instance workloads can freely provision dependent services.
  5. E
    Provision a private GKE cluster for the build workers while leaving control plane authorized networks disabled to allow unrestricted external management access.

Cevap

To securely and reliably provision compute resources using automated pipelines, configure a Cloud Storage backend with object versioning and state locking for Terraform, grant the deployment worker the Service Account User role on the target workload service account, and request regional resource quotas prior to scaling deployment capacity.
Safe compute provisioning requires establishing remote state locks on IaC backends to prevent concurrent modification, applying the Service Account User role to delegate compute identity access securely, and verifying regional compute quota headroom in advance of scaling operations.

Adım Adım Çözüm

1
Configure backend state storage for automated provisioning pipelines.
Terraform state is stored remotely in Cloud Storage with locking and object versioning to avoid race conditions and state corruption.
Safe Infrastructure as Code execution requires centralized state locking when multiple automated execution pipelines run concurrently.
2
Enforce fine-grained IAM permissions for service account delegation.
The CI/CD pipeline account impersonates or attaches specific runtime service accounts using `roles/iam.serviceAccountUser` instead of holding broad administration permissions.
Following least privilege prevents automated deployment tools from having full resource control across the project.
3
Validate compute capacity constraints before provisioning.
Regional CPU and VM instance quota limits are checked and expanded in advance of launching large Managed Instance Groups.
Automated deployments will encounter API errors and fail mid-rollout if regional quota limits are exceeded.

Anahtar Kavram

Best practices for provisioning Compute Engine resources using Infrastructure as Code (IaC) state management, IAM least privilege, and resource quota planning.
Bu soruyu puanla

Konular

Provisioning Compute Engine and Kubernetes Engine Clusters

Bu konudan daha fazla soru