Examkin

Soru

Zorluk: OrtaBuilding and Managing Infrastructure as Code (IaC)

A healthcare telemetry platform manages its Google Cloud infrastructure using Terraform. The cloud engineering team needs to establish a backend configuration for storing Terraform state files across dev, staging, and production environments. The strategy must prevent concurrent deployment race conditions, protect state files against accidental overwrites or corruption, enforce least-privilege administrative access, and support full operational auditability. Which configuration best meets these requirements?

  1. A
    Store Terraform state files on a local persistent disk attached to a shared CI/CD worker node and sync state files to Cloud Storage after each execution.
  2. Provision a Google Cloud Storage bucket with Object Versioning enabled and uniform bucket-level access, configured as a remote backend with native state locking.Cevap
  3. C
    Grant the primitive Editor IAM role on the Cloud Storage state bucket to all deployment pipeline service accounts to prevent permission errors during deployment.
  4. D
    Perform manual resource creation via the Google Cloud Console when Terraform deployment pipelines fail, updating state metadata after console modifications.

Cevap

Provision a Google Cloud Storage bucket with Object Versioning enabled and uniform bucket-level access, configured as a remote backend with native state locking.
Configuring a Google Cloud Storage bucket with Object Versioning enabled, uniform bucket-level access, and native state locking satisfies all governance, durability, and concurrency requirements. Native state locking prevents concurrent pipeline executions from corrupting state, Object Versioning permits recovery from accidental overwrites or corruption, and uniform bucket-level access paired with granular IAM roles enforces least privilege.

Adım Adım Çözüm

1
Identify key operational requirements for production-grade Terraform state management
Requirements include remote centralized state storage, state locking to prevent race conditions during concurrent runs, Object Versioning for disaster recovery, and fine-grained access control.
Infrastructure as Code state files store critical cloud resources mappings and require durability, concurrency control, and point-in-time recovery capabilities.
2
Evaluate Google Cloud Storage features for Terraform state backends
GCS backends natively support state locking using storage object metadata locks, while GCS Object Versioning provides automated history retention for state restoration.
Using native GCS backend capabilities fulfills high-availability and security requirements without adding external database complexity.
3
Apply Security Least-Privilege IAM Controls
Enforcing uniform bucket-level access and assigning granular predefined storage roles (such as Storage Object Admin for pipeline service accounts) ensures proper operational security.
Avoiding primitive IAM roles ensures compliance with Google Cloud security best practices.

Anahtar Kavram

Terraform Remote Backend State Management and Security Governance in Cloud Storage
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Building and Managing Infrastructure as Code (IaC)

Bu konudan daha fazla soru