Examkin

Soru

Zorluk: OrtaProvisioning Compute Engine and Kubernetes Engine Clusters

A biomedical research company is automating the infrastructure provisioning process on Google Cloud for a distributed genomic processing platform. The architecture requires deploying a private Google Kubernetes Engine (GKE) cluster for core compute services alongside automated Terraform pipelines for provisioning Compute Engine Managed Instance Groups (MIGs). The security and operations teams require that administrative control plane access to the private GKE cluster be strictly limited to trusted corporate networks, and that infrastructure state storage prevents concurrent execution conflicts or loss of state history. Which TWO deployment configuration actions should the Cloud Architect recommend to fulfill these operational and security constraints?

  1. Configure control plane authorized networks on the private GKE cluster using explicit corporate CIDR ranges.Cevap
  2. Configure a Google Cloud Storage remote backend with object versioning and state locking for Terraform state management.Cevap
  3. C
    Grant the Service Account Admin role (roles/iam.serviceAccountAdmin) to the CI/CD pipeline service account to allow instance template provisioning.
  4. D
    Maintain the Infrastructure as Code (IaC) state file in unversioned local storage within the transient CI/CD runner container to maximize build execution speed.
  5. E
    Provision an additional dedicated GKE cluster to serve simple stateless static documentation microservices.

Cevap

The correct architecture requires enabling control plane authorized networks with explicit corporate CIDR ranges on the private GKE cluster and storing Terraform state in a Google Cloud Storage backend configured with object versioning and state locking.
Configuring control plane authorized networks on private GKE clusters ensures master endpoint communication is strictly constrained to authorized corporate IP blocks. Concurrently, using Google Cloud Storage as a remote backend with versioning and state locking protects infrastructure state from corruption and concurrent pipeline conflicts.

Adım Adım Çözüm

1
Evaluate private GKE cluster control plane security requirements.
Identified that restricting master endpoint access requires configuring GKE control plane authorized networks with specific CIDR blocks.
Private GKE clusters require explicit authorized network rules to block unauthorized public network requests to the control plane.
2
Evaluate Infrastructure as Code (IaC) state management best practices.
Identified that Cloud Storage backend with state locking and object versioning fulfills concurrency and resilience needs.
Centralized, locked, and versioned remote backends prevent state corruption during automated CI/CD runs.
3
Analyze distractor options regarding IAM roles, IaC state, and compute platform selection.
Eliminated options recommending excessive IAM primitive/admin roles, local state storage, and redundant cluster creation.
These options violate least privilege, introduce state corruption risks, or add unnecessary operational complexity.

Anahtar Kavram

Provisioning private GKE clusters with control plane authorized networks and securing automated IaC state management in Cloud Storage.
Bu soruyu puanla

Konular

Provisioning Compute Engine and Kubernetes Engine Clusters

Bu konudan daha fazla soru