Google Professional Cloud Developer Question 146
Select 3Google Cloud PlatformYour team is developing a critical cloud-native application and wants to ensure the integrity and security of the software supply chain by adhering to the SLSA framework. Which of the following steps should you prioritize to achieve SLSA Level 3 compliance?
- A
Implement a build system that generates tamper-evident provenance for all builds.
- B
Enforce two-person code review for all changes in the source repository.
- C
Utilize a build system that supports hermetic builds to prevent dependency tampering.
- D
Manually validate the integrity of third-party dependencies before each build.
- E
Ensure the source repository requires authenticated access with granular permissions.
Show answer and explanation
Correct answers: A, C, E
Explanation
SLSA (Supply-chain Levels for Software Artifacts) is a framework designed to protect the integrity of the software supply chain. Achieving SLSA Level 3 requires build systems to generate tamper-evident provenance and support hermetic builds. Additionally, securing the source repository with authenticated access is critical for protecting the software supply chain. These measures collectively ensure that the software artifacts are secure and trustworthy.
- A. Correct.
Implementing a build system that generates tamper-evident provenance is a key requirement for achieving SLSA Level 3. It ensures that the build process can be traced and verified.
- B. Incorrect.
While enforcing two-person code review improves code quality and security, it is not a specific requirement for SLSA Level 3 compliance.
- C. Correct.
Using a build system that supports hermetic builds is critical for SLSA Level 3 as it ensures that builds are isolated and cannot be influenced by external factors, such as tampered dependencies.
- D. Incorrect.
Manually validating dependencies is not scalable or reliable for SLSA Level 3 compliance. Automated systems are preferred for robust security.
- E. Correct.
Ensuring authenticated access with granular permissions is necessary to protect the source repository from unauthorized access, which is a key aspect of the SLSA framework.