Examkin

Soru

Zorluk: OrtaBuilding and Managing Infrastructure as Code (IaC)

A renewable energy analytics company uses Terraform to manage its Google Cloud infrastructure across multiple projects. During a recent operational incident, an engineer manually modified server instance types and firewall rules directly in the Google Cloud Console. The automated CI/CD pipeline subsequently failed during execution due to state drift between live resources and version-controlled Terraform code. The cloud architecture team must resolve the configuration drift while ensuring long-term IaC governance and compliance. Which strategy should the cloud architect recommend?

  1. Update the Terraform configuration files to reflect any intended console modifications, run terraform plan to inspect differences, execute terraform apply to reconcile live state with code, and restrict direct Console edit permissions.Cevap
  2. B
    Allow manual Cloud Console modifications for emergency incidents and run terraform refresh in the CI/CD pipeline to automatically overwrite repository configuration files with live state.
  3. C
    Delete the remote state file stored in the Cloud Storage backend and execute terraform init to regenerate state directly from active Google Cloud resources.
  4. D
    Grant the Owner primitive IAM role to the deployment service account to bypass backend state locking errors and force infrastructure updates.

Cevap

Reconcile configuration drift by updating Terraform HCL code to match valid changes or executing terraform apply to revert unauthorized edits, while restricting direct Cloud Console mutation access through IAM least privilege.
The correct approach enforces Infrastructure as Code best practices by reconciling code and live infrastructure, then enforcing least-privilege IAM controls so all future changes flow through automated pipelines.

Adım Adım Çözüm

1
Inspect out-of-band changes using terraform plan
Identify exact resource properties modified manually in the Cloud Console compared to desired code definitions.
Understanding state divergence is required before deciding whether to incorporate or revert live changes.
2
Reconcile version-controlled code and execute terraform apply
Bring live Google Cloud infrastructure back into full alignment with repository HCL definitions.
Infrastructure as Code requires version-controlled repository definitions to be the single authoritative source of truth.
3
Enforce IAM least privilege and CI/CD execution boundaries
Remove direct write access to production resources from individual users, requiring all modifications to pass through audited automated pipelines.
Preventing unauthorized manual edits eliminates recurring infrastructure drift.

Anahtar Kavram

Building and Managing Infrastructure as Code (IaC)
Bu soruyu puanla

Konular

Building and Managing Infrastructure as Code (IaC)

Bu konudan daha fazla soru