Professional Cloud DevOps Engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Last updated
Your enterprise is establishing a continuous integration and continuous deployment (CI/CD) GitOps pipeline using Cloud Build and Terraform to manage infrastructure across dev, stage, and prod Google Cloud projects.
Your security and compliance teams require the following:
Which pipeline design should you implement to meet these requirements?
Store all Terraform state files in a single, centralized Cloud Storage bucket with Fine-Grained Object ACLs. Grant the default Cloud Build Service Agent roles/owner across the Google Cloud organization, and execute terraform apply --auto-approve immediately upon pull request creation.
Deploy a Compute Engine instance pool running a scheduled hourly cron job that pulls the main branch, disables state locking with -lock=false, and applies changes simultaneously to dev, stage, and prod projects using the default Compute Engine service account.
Configure isolated Cloud Storage backend buckets per environment with Object Versioning and Uniform Bucket-Level Access enabled. Create Cloud Build triggers for pull requests that run terraform plan and validate the plan against policies using Open Policy Agent (OPA) or Conftest. Configure branch-specific triggers for promotion that impersonate environment-dedicated Service Accounts.
Commit the encrypted Terraform .tfstate files directly to the Git repository branches using git-crypt. Configure Cloud Build to execute terraform apply locally on each developer's workstation using developer OAuth credentials before code check-in.
Store all Terraform state files in a single, centralized Cloud Storage bucket with Fine-Grained Object ACLs. Grant the default Cloud Build Service Agent roles/owner across the Google Cloud organization, and execute terraform apply --auto-approve immediately upon pull request creation.
Deploy a Compute Engine instance pool running a scheduled hourly cron job that pulls the main branch, disables state locking with -lock=false, and applies changes simultaneously to dev, stage, and prod projects using the default Compute Engine service account.
Configure isolated Cloud Storage backend buckets per environment with Object Versioning and Uniform Bucket-Level Access enabled. Create Cloud Build triggers for pull requests that run terraform plan and validate the plan against policies using Open Policy Agent (OPA) or Conftest. Configure branch-specific triggers for promotion that impersonate environment-dedicated Service Accounts.
This architecture establishes an enterprise-grade GitOps CI/CD pipeline for Infrastructure as Code (IaC) on Google Cloud. It utilizes Cloud Build, Terraform remote backends on Cloud Storage, automated Policy-as-Code (PaC) validation, and IAM Service Account Impersonation to enforce least privilege across isolated environments.
StudyCerts
StudyCertsdev and prod. Enabling Object Versioning protects state files against corruption or accidental deletion, while the native Google Cloud Storage backend automatically handles state locking via Cloud Storage generation numbers.terraform plan output to JSON and validates it against predefined compliance policies using tools like Open Policy Agent (OPA) or Conftest. This prevents policy-violating resources (such as overly permissive IAM bindings or public firewall rules) from ever reaching production.dev, stage, and prod. Cloud Build pipelines run using dedicated, environment-scoped Service Accounts via IAM impersonation, ensuring non-production build steps have zero access to production resources.This approach aligns with Google Cloud architecture best practices for Terraform at scale. It completely segregates privileges, automates pre-merge governance, and eliminates long-lived static service account keys in CI/CD pipelines.
Commit the encrypted Terraform .tfstate files directly to the Git repository branches using git-crypt. Configure Cloud Build to execute terraform apply locally on each developer's workstation using developer OAuth credentials before code check-in.