Google Professional Cloud Developer Question 148
Select 3Google Cloud PlatformYour team is developing and deploying a critical application on Google Cloud, and you want to ensure the security and integrity of your software supply chain using the SLSA (Supply-chain Levels for Software Artifacts) framework. Which of the following actions align with achieving a higher SLSA level to secure your software supply chain?
- A
Implement automated, verifiable builds with provenance metadata.
- B
Use only open-source dependencies without verifying their sources.
- C
Ensure your build process is completely isolated from manual interventions.
- D
Sign and verify all artifacts produced during the build process.
- E
Store build logs locally on developer machines for audit purposes.
Show answer and explanation
Correct answers: A, C, D
Explanation
The SLSA framework provides a set of practices to improve the security and integrity of software supply chains. Achieving higher SLSA levels involves measures such as automated builds with provenance metadata, isolating build processes from manual interventions, and signing/verifying artifacts. These practices protect against supply chain attacks and ensure traceability and security in the software development lifecycle.
- A. Correct.
Implementing automated, verifiable builds with provenance metadata is a key step in achieving higher SLSA levels. It ensures that builds are tamper-proof and traceable.
- B. Incorrect.
Using open-source dependencies without verifying their sources introduces risk, as dependencies could contain vulnerabilities or malicious code. This does not align with SLSA's requirements.
- C. Correct.
Ensuring the build process is isolated from manual interventions is essential for achieving higher SLSA levels. It reduces the risk of human errors and tampering.
- D. Correct.
Signing and verifying all artifacts ensures the authenticity and integrity of software artifacts, which is a critical requirement for a secure software supply chain as per SLSA.
- E. Incorrect.
Storing build logs locally on developer machines is not secure or compliant with SLSA best practices. Logs should be stored in tamper-proof, centralized locations for proper auditing.