GCP Professional Cloud Architect Practice Question

Your organization manages 50 Google Cloud projects that follow a hub-and-spoke VPC design. Network engineers currently bootstrap each new project with gcloud commands from their laptops, which has resulted in configuration drift and inconsistent IAM role assignment. Leadership now mandates that infrastructure changes be 1) defined as code in a single source-of-truth, 2) subjected to peer review before execution, and 3) automatically halt the pipeline and surface an alert if the apply step fails so engineers can remediate quickly. In line with the operational excellence pillar of the Google Cloud Well-Architected Framework, which implementation best meets these goals?

Store Deployment Manager templates in Cloud Storage and have engineers manually launch deployments from Cloud Shell when new projects are created.
Create reusable Terraform modules for the shared VPC and IAM policies, store them in a Git repository, and configure Cloud Build to run terraform plan on pull requests and terraform apply after a manual approval, using Cloud Storage as the remote state backend so any apply failure stops the pipeline and triggers alerts.
Maintain bash scripts with gcloud commands in Cloud Source Repositories and instruct engineers to run the scripts locally after emailing their changes for peer review.
Enable VPC Service Controls and enforce an Organization Policy that blocks manual network changes; recreate resources through the Cloud Console when updates are needed.

Report Issue

Answer Description

Storing Terraform modules in a version-controlled repository establishes a single source-of-truth and eliminates ad-hoc local scripts. A Cloud Build trigger that runs terraform plan on every pull request allows peers to review the planned changes before they are applied. After a manual approval, Cloud Build can execute terraform apply using a Cloud Storage remote state backend, ensuring that all state is centralized and auditable across the 50 projects. If the apply step fails, Cloud Build marks the build as failed and sends notifications, stopping the pipeline so engineers can investigate and remediate. The other options either rely on manual execution, perpetuate local script usage, or fail to provide a peer-reviewed, code-based workflow.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.