Google Professional Cloud Developer Question 145
Select 2Google Cloud PlatformYou are a developer at a company that wants to improve the security of its software supply chain. To meet compliance requirements, you need to ensure that your build processes are tamper-resistant and reproducible. Which of the following actions align with achieving a Supply-chain Levels for Software Artifacts (SLSA) Level 3 compliance?
- A
Use a build service that generates verifiable provenance for all artifacts.
- B
Sign the source code with a developer's private GPG key before every commit.
- C
Ensure the build process is performed in an isolated, ephemeral environment.
- D
Use a version control system that supports signed commits and branch protection rules.
- E
Manually upload built artifacts to your artifact repository after reviewing them.
Show answer and explanation
Correct answers: A, C
Explanation
SLSA Level 3 focuses on ensuring that build systems are secure, tamper-resistant, and generate verifiable provenance for all artifacts. Using an isolated, ephemeral build environment and a build service that generates provenance directly addresses these requirements, making options 1 and 3 correct. Other options either do not align with SLSA Level 3's requirements or introduce risks that SLSA aims to mitigate.
- A. Correct.
Correct. SLSA Level 3 requires that all build processes generate verifiable provenance, which ensures the traceability and integrity of artifacts.
- B. Incorrect.
Incorrect. While signing commits with a private GPG key improves code integrity, it does not directly contribute to achieving SLSA Level 3, which focuses on the build process and artifact provenance.
- C. Correct.
Correct. SLSA Level 3 mandates that builds are performed in isolated, ephemeral environments to ensure tamper resistance and reproducibility.
- D. Incorrect.
Incorrect. While using signed commits and branch protection rules is a good practice for securing the source code, it is not specifically required for SLSA Level 3 compliance.
- E. Incorrect.
Incorrect. Manually uploading artifacts introduces potential human error and tampering risks, which contradicts the requirements of SLSA Level 3.