Your enterprise organization is establishing a standardized Infrastructure-as-Code (IaC) workflow across multiple projects. The engineering team needs to meet the following requirements: Deploy and manage Google Cloud resources using standard HashiCorp or Google-maintained Terraform configurations. Eliminate the operational burden of provisioning, securing, and maintaining self-hosted execution environments and remote state storage. Execute and track IaC deployment lifecycles directly through a fully managed Google Cloud control plane and API (config.googleapis.com). Which tool or service should you implement to satisfy these requirements?

Infrastructure Manager: ### What Infrastructure Manager is **Infrastructure Manager** is a fully managed service on Google Cloud that automates the deployment and lifecycle management of infrastructure using **Terraform**. It operates via the `config.googleapis.com` API and handles the execution of Terraform configurations natively within Google Cloud. ### How it meets the requirements - **Standard Terraform support**: Infrastructure Manager natively supports standard Terraform configurations, allowing teams to choose between the HashiCorp-maintained provider or the Google Cloud-maintained provider (`SERVICE_MAINTAINED`). - **Managed execution and state**: The service provisions managed execution environments to plan and apply configurations while automatically handling backend state storage in secure, managed Cloud Storage buckets. - **Native GCP API integration**: All deployments, revisions, and actuation tracking are controlled through native Google Cloud APIs (`config.googleapis.com`), Cloud SDK commands (`gcloud infra-manager`), and Google Cloud console interfaces. ### Key advantages and capabilities - **Zero runner maintenance**: Eliminates the need to maintain self-hosted CI/CD runners, Terraform Cloud instances, or custom worker pools for standard infrastructure provisioning. - **Centralized IAM and governance**: Integrates with Google Cloud Identity and Access Management (IAM) and Cloud Audit Logs to provide auditable, role-based access control over deployments. - **Automated state locking and storage**: Protects state files against concurrency conflicts and unauthorized tampering without manual bucket configuration. - **Git integration**: Can fetch configurations directly from Cloud Source Repositories, GitHub, or Cloud Storage buckets. ### Why this is optimal Infrastructure Manager provides a turnkey, serverless orchestration layer for Terraform workflows natively within Google Cloud, meeting all operational and architectural criteria without requiring external tooling or containerized orchestrators.

Compare Gcp Iac Infrastructure Manager Selection | Professional Cloud DevOps Engineer

AdvancedProfessional Cloud DevOps Engineer

A DevOps engineering team is designing an automated Infrastructure as Code (IaC) pipeline using Terraform to provision multi-tenant environments and Google Kubernetes Engine (GKE) clusters across an enterprise Google Cloud organization. The deployment strategy must satisfy the following architectural and operational requirements: State Management & Concurrency: Terraform state must be securely centralized, resilient against data loss, protected against concurrent modifications, and encrypted. Least Privilege & Secret Security: Automated CI/CD execution pipelines must authenticate to Google Cloud without storing long-lived service account private keys, and application/infrastructure secrets must be managed dynamically without embedding sensitive values in plain text files. Modular Governance: The pipeline must standardize project provisioning, networking, and access policies using Google-recommended, reusable blueprints. Which architecture and integration pattern should the DevOps team implement?

Infrastructure-as-code tooling and managed services (e.g., Infrastructure Manager, Cloud Foundation Toolkit, Config Connector, GitOps, Terraform, Helm)

AdvancedProfessional Cloud DevOps Engineer

Your enterprise organization is designing an automated GitOps workflow across multi-tenant Google Kubernetes Engine (GKE) clusters to manage infrastructure configurations and Kubernetes policies. The design must satisfy the following operational requirements: Maintain strict isolation between cluster-scoped platform resources and tenant-scoped application resources. Isolate reconciler execution to prevent failure in one tenant repository from blocking deployments in others. Continuously monitor Git repositories, detect configuration drift caused by manual kubectl interventions, and automatically remediate the drift back to the declared source state. How should you configure the GitOps synchronization architecture using Config Sync?

AdvancedProfessional Cloud DevOps Engineer

Your enterprise organization is designing a continuous integration and continuous delivery (CI/CD) pipeline architecture on Google Cloud to build and deploy critical applications. The security governance team mandates strict compliance with the following security requirements: Least-privilege execution: Builds must run using dedicated identities with fine-grained IAM permissions tailored strictly to the required pipeline tasks, avoiding broad default service account privileges. Network perimeter and isolation: Pipeline execution environments must be completely isolated from the public internet, hosted in a private Virtual Private Cloud (VPC) network, and contained within a VPC Service Controls (VPC-SC) security perimeter to prevent source code and artifact exfiltration. Secure secret access: Sensitive API keys and deployment credentials must be securely consumed dynamically during pipeline execution without storing long-lived service account keys in repositories or persisting secrets in build configuration files. Which architecture and configuration strategy should the DevOps team implement?

AdvancedProfessional Cloud DevOps Engineer

Your enterprise operates dozens of microservices across multiple Google Cloud projects managed by separate product engineering teams. During a recent financial review, the FinOps team discovered that observability spend has increased dramatically, driven by high volumes of custom Cloud Trace spans and untracked shared monitoring telemetry. You need to establish a FinOps governance strategy that controls distributed tracing costs while preserving end-to-end performance diagnostic visibility, enables precise chargeback attribution to individual development teams, and provides proactive financial alerting. Which combination of actions should you implement?

AdvancedProfessional Cloud DevOps Engineer

An enterprise DevOps team is designing an automated workflow to ingest and process Google Cloud Recommender suggestions across multiple production projects within their GitOps CI/CD pipeline. The governance policy defines the following criteria: Low-risk operating system and runtime compliance baselines must be automatically remediated and enforced. High-risk security modifications (such as reducing over-privileged permissions identified by IAM Recommender or changing Cloud Service Mesh authorization policies) must be classified for human review via peer-reviewed pull requests rather than being applied directly. The CI/CD pipeline service account must follow the principle of least privilege for recommendation discovery. Which workflow and configuration should the team implement?

FundamentalAssociate Data Practitioner

A retail company is designing a data ingestion pipeline to process customer purchases and inventory adjustments. The architecture must satisfy the following requirements: Ingest and make event data available in BigQuery for near real-time operational analytics as events occur Fully decouple the event producers from downstream analytics systems so that new analytical consumers can be added later without modifying existing producers Support asynchronous messaging that records factual events rather than requiring producers to manage downstream consumer state Which architectural approach best addresses these requirements?

Professional Cloud DevOps Engineer

Compare Gcp Iac Infrastructure Manager Selection

Related questions