Google Professional Cloud Developer Question 149
Select 3Google Cloud PlatformYou are developing a CI/CD pipeline for your organization's software development process. Your security team has requested that you implement a process to ensure the integrity and provenance of the software artifacts being deployed. They specifically want the pipeline to meet SLSA Level 3 requirements. Which of the following actions should you take to meet this goal?
- A
Ensure your build system generates provenance metadata for all artifacts and is tamper-resistant.
- B
Store all artifacts and metadata in a public artifact registry to promote transparency.
- C
Adopt a hermetic and reproducible build process to ensure builds are isolated from external inputs.
- D
Require developers to manually validate each artifact before deployment.
- E
Use a build system that is centrally managed and enforces access control policies.
Show answer and explanation
Correct answers: A, C, E
Explanation
SLSA (Supply-chain Levels for Software Artifacts) is a framework designed to improve the security and integrity of software supply chains. SLSA Level 3 focuses on ensuring build integrity with tamper-resistant systems, hermetic builds, and proper access controls. By implementing these measures, you can meet the requirements for SLSA Level 3 and secure your CI/CD pipeline.
- A. Correct.
Correct: SLSA Level 3 requires build provenance metadata to be included and ensures that the build system is tamper-resistant to prevent unauthorized modifications.
- B. Incorrect.
Incorrect: While storing artifacts in a public repository can promote transparency, it is not a requirement for SLSA Level 3. Provenance and security controls are more critical.
- C. Correct.
Correct: A hermetic and reproducible build ensures builds are deterministic and not influenced by external inputs, which aligns with SLSA Level 3 requirements.
- D. Incorrect.
Incorrect: Manual validation by developers does not meet SLSA Level 3 standards, as SLSA focuses on automated and secure processes rather than manual checks.
- E. Correct.
Correct: A centrally managed build system with enforced access controls is necessary to meet SLSA Level 3 requirements, as it ensures secure and controlled builds.