Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

Google Professional Cloud DevOps Engineer Exam - Topic 4 Question 86 Discussion

Your uses Jenkins running on Google Cloud VM instances for CI/CD. You need to extend the functionality to use infrastructure as code automation by using Terraform. You must ensure that the Terraform Jenkins instance is authorized to create Google Cloud resources. You want to follow Google-recommended practices- What should you do?
C) Confirm that the Jenkins VM instance has an attached service account with the appropriate Identity and Access Management (IAM) permissions.
A) Add the auth application-default command as a step in Jenkins before running the Terraform commands.
B) Create a dedicated service account for the Terraform instance. Download and copy the secret key value to the GOOGLE environment variable on the Jenkins server.
D) use the Terraform module so that Secret Manager can retrieve credentials.

Google Professional Cloud DevOps Engineer Exam - Topic 4 Question 86 Discussion

Actual exam question for Google's Professional Cloud DevOps Engineer exam
Question #: 86
Topic #: 4
[All Professional Cloud DevOps Engineer Questions]

Your uses Jenkins running on Google Cloud VM instances for CI/CD. You need to extend the functionality to use infrastructure as code automation by using Terraform. You must ensure that the Terraform Jenkins instance is authorized to create Google Cloud resources. You want to follow Google-recommended practices- What should you do?

Show Suggested Answer Hide Answer
Suggested Answer: C

The correct answer is C)

Confirming that the Jenkins VM instance has an attached service account with the appropriate Identity and Access Management (IAM) permissions is the best way to ensure that the Terraform Jenkins instance is authorized to create Google Cloud resources. This follows the Google-recommended practice of using service accounts to authenticate and authorize applications running on Google Cloud1. Service accounts are associated with private keys that can be used to generate access tokens for Google Cloud APIs2. By attaching a service account to the Jenkins VM instance, Terraform can use the Application Default Credentials (ADC) strategy to automatically find and use the service account credentials3.

Answer A is incorrect because the auth application-default command is used to obtain user credentials, not service account credentials. User credentials are not recommended for applications running on Google Cloud, as they are less secure and less scalable than service account credentials1.

Answer B is incorrect because it involves downloading and copying the secret key value of the service account, which is not a secure or reliable way of managing credentials. The secret key value should be kept private and not exposed to any other system or user2. Moreover, setting the GOOGLE environment variable on the Jenkins server is not a valid way of providing credentials to Terraform. Terraform expects the credentials to be either in a file pointed by the GOOGLE_APPLICATION_CREDENTIALS environment variable, or in a provider block with the credentials argument3.

Answer D is incorrect because it involves using the Terraform module for Secret Manager, which is a service that stores and manages sensitive data such as API keys, passwords, and certificates. While Secret Manager can be used to store and retrieve credentials, it is not necessary or sufficient for authorizing the Terraform Jenkins instance. The Terraform Jenkins instance still needs a service account with the appropriate IAM permissions to access Secret Manager and other Google Cloud resources.


by Mabel at Jan 21, 2025, 11:56 PM

Limited Time Offer

25%

Off

Get Premium Professional Cloud DevOps Engineer Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Jerilyn
9 months ago
I’m not sure about D, isn’t that overcomplicating things?
upvoted 0 times
...
Leandro
9 months ago
C makes the most sense, IAM is crucial!
upvoted 0 times
...
Ricki
10 months ago
Wait, can you really just use the auth command in A? Sounds risky.
upvoted 0 times
...
Eleonora
10 months ago
I think B is better for security.
upvoted 0 times
...
Raelene
10 months ago
Option C is definitely the way to go!
upvoted 0 times
...
Tonette
10 months ago
I feel like using Secret Manager for credentials is a good security practice, but I’m not confident if it’s the right answer here.
upvoted 0 times
...
Loren
11 months ago
I practiced a similar question where creating a dedicated service account was emphasized, so option B seems like a solid choice.
upvoted 0 times
...
Harrison
11 months ago
I’m not entirely sure, but I think using application-default commands might not be the best practice for CI/CD.
upvoted 0 times
...
Kris
11 months ago
I remember something about service accounts being crucial for accessing Google Cloud resources, so option C sounds familiar.
upvoted 0 times
...
Noemi
11 months ago
I think the answer is B. Creating a dedicated service account for the Terraform instance and passing the credentials through an environment variable seems like the most secure and recommended approach.
upvoted 0 times
...
Ernestine
11 months ago
I'm a little confused by the options here. I'm not super familiar with Terraform and Jenkins, so I'll need to review the material again before I can confidently answer this.
upvoted 0 times
...
Irma
11 months ago
Okay, I've got this. The answer is C - we need to make sure the Jenkins VM instance has the right IAM permissions to create resources. That's the Google-recommended approach.
upvoted 0 times
...
Ronny
11 months ago
Hmm, I'm a bit unsure about this one. There are a few options presented, and I'm not sure which one is the Google-recommended best practice. I'll need to think this through carefully.
upvoted 0 times
...
Malcom
11 months ago
This looks like a straightforward question about setting up Terraform with Jenkins on Google Cloud. I think the key is ensuring the Jenkins instance has the right permissions to create resources.
upvoted 0 times
...
Dulce
11 months ago
I'm feeling pretty confident about this one. The Google-recommended practice is to use a service account with the right IAM permissions. That's the cleanest and most secure way to authorize the Terraform Jenkins instance.
upvoted 0 times
...
Ettie
11 months ago
Okay, I think I've got this. The best approach is to create a dedicated service account for the Terraform instance and set the GOOGLE environment variable on the Jenkins server. That way, the Terraform commands will have the necessary permissions.
upvoted 0 times
...
Rebeca
11 months ago
Hmm, I'm a bit confused about the different options here. I'm not sure if I should use a service account, the auth application-default command, or check the IAM permissions. I'll need to review the Google-recommended practices more closely.
upvoted 0 times
...
Keneth
11 months ago
This looks like a straightforward question about setting up Terraform with Jenkins on Google Cloud. I think the key is ensuring the Jenkins instance has the right permissions to create resources.
upvoted 0 times
...
Dianne
2 years ago
I personally prefer option D because it utilizes Secret Manager for credential retrieval, which adds an extra layer of security.
upvoted 0 times
...
Rebbecca
2 years ago
That's a good point, but I still think option B provides more control over the Terraform instance.
upvoted 0 times
...
Felicidad
2 years ago
I'm going with B. It's the Google-recommended practice, and it's better to be safe with credentials than sorry.
upvoted 0 times
Chaya
1 year ago
I think both options are important for security measures.
upvoted 0 times
...
Dong
2 years ago
C) Confirm that the Jenkins VM instance has an attached service account with the appropriate Identity and Access Management (IAM) permissions.
upvoted 0 times
...
Irma
2 years ago
That sounds like a secure way to handle credentials.
upvoted 0 times
...
Giuseppe
2 years ago
B) Create a dedicated service account for the Terraform instance. Download and copy the secret key value to the GOOGLE environment variable on the Jenkins server.
upvoted 0 times
...
...
Ira
2 years ago
D seems like an overly complicated approach. Why use Secret Manager when you can just set the environment variable?
upvoted 0 times
...
Hoa
2 years ago
C looks good to me. If the Jenkins VM has the right IAM permissions, that should be the easiest solution.
upvoted 0 times
Alexia
1 year ago
User4: I'm leaning towards option C as well. If the Jenkins VM already has the right IAM permissions, it would be the most straightforward choice.
upvoted 0 times
...
Precious
1 year ago
User3: I think we should consider option B) Create a dedicated service account for the Terraform instance. Download and copy the secret key value to the GOOGLE environment variable on the Jenkins server.
upvoted 0 times
...
Lettie
1 year ago
User2: I agree with User1, but option C) Confirm that the Jenkins VM instance has an attached service account with the appropriate IAM permissions seems like a simpler solution.
upvoted 0 times
...
Clarence
2 years ago
User1: I think we should go with option A) Add the auth application-default command as a step in Jenkins before running the Terraform commands.
upvoted 0 times
...
...
Nan
2 years ago
I disagree, I believe option C is the way to go as it directly checks the IAM permissions on the Jenkins VM instance.
upvoted 0 times
...
Aja
2 years ago
I think the answer is B. Creating a dedicated service account and using the environment variable is the safest and most recommended approach.
upvoted 0 times
Kristel
2 years ago
C) Confirm that the Jenkins VM instance has an attached service account with the appropriate Identity and Access Management (IAM) permissions.
upvoted 0 times
...
Tran
2 years ago
B) Create a dedicated service account for the Terraform instance. Download and copy the secret key value to the GOOGLE environment variable on the Jenkins server.
upvoted 0 times
...
...
Rebbecca
2 years ago
I think option B is the best choice because it ensures security by using a dedicated service account.
upvoted 0 times
...

Save Cancel