Google Professional Cloud Developer Question 147
Select 3Google Cloud PlatformYour team is developing a CI/CD pipeline to build and deploy a microservice on Google Cloud. As part of enhancing the security of your software supply chain, you decide to adopt SLSA (Supply-chain Levels for Software Artifacts) standards. Which of the following practices align with achieving SLSA Level 3 requirements?
- A
Using a build service that generates provenance and prevents tampering
- B
Manually signing build artifacts to ensure integrity
- C
Storing build provenance data in a secure, immutable environment
- D
Using isolated, ephemeral environments for building artifacts
- E
Allowing developers to directly modify production builds if needed
Show answer and explanation
Correct answers: A, C, D
Explanation
SLSA Level 3 focuses on integrity and trust in the software supply chain by requiring automated provenance generation, secure storage of provenance, and isolated, ephemeral build environments. These measures help ensure that the software artifacts are not tampered with and originate from a secure build process.
- A. Correct.
Correct: SLSA Level 3 requires using a build service that generates provenance and ensures tampering is prevented.
- B. Incorrect.
Incorrect: Manually signing artifacts does not meet the automated and tamper-proof provenance generation required by SLSA Level 3.
- C. Correct.
Correct: Storing provenance data securely and immutably aligns with SLSA Level 3 to ensure the integrity of the supply chain.
- D. Correct.
Correct: Isolated and ephemeral build environments are required by SLSA Level 3 to minimize the risk of persistence and tampering.
- E. Incorrect.
Incorrect: Allowing developers to modify production builds undermines supply chain security and does not comply with SLSA standards.