Google Professional Cloud DevOps Engineer Question 195
Select 3Google Cloud PlatformYour organization uses a CI/CD pipeline hosted on Google Cloud to deploy applications to production. During a security audit, it was identified that unauthorized changes could potentially be made to the deployment pipeline configuration. As a DevOps Engineer, which actions should you take to improve the security of the CI/CD tooling and ensure only authorized users can make changes?
- A
Implement IAM roles with the principle of least privilege for access to the pipeline configuration.
- B
Enable audit logging for the CI/CD pipeline to monitor configuration changes.
- C
Grant all developers 'Editor' permissions to streamline the development process.
- D
Use a dedicated service account with restricted permissions for pipeline execution.
- E
Disable encryption for the pipeline's secrets to improve performance.
Show answer and explanation
Correct answers: A, B, D
Explanation
To secure CI/CD tooling, it is critical to implement IAM roles with the least privilege principle, enable audit logging for traceability, and use dedicated service accounts with restricted permissions for pipeline execution. These actions reduce the risk of unauthorized access, provide visibility into configuration changes, and ensure secure handling of sensitive operations. Granting excessive permissions or disabling security measures like encryption would weaken the security posture of the CI/CD pipeline.
- A. Correct.
Implementing IAM roles with the principle of least privilege ensures only authorized users can access and modify the pipeline configuration, reducing the risk of unauthorized changes.
- B. Correct.
Enabling audit logging allows you to track who made configuration changes and when, providing traceability and aiding in incident response.
- C. Incorrect.
Granting all developers 'Editor' permissions violates the principle of least privilege and increases the risk of misconfigurations or unauthorized changes.
- D. Correct.
Using a dedicated service account with restricted permissions ensures that the pipeline execution has only the necessary permissions, minimizing the attack surface.
- E. Incorrect.
Disabling encryption for the pipeline's secrets compromises the security of sensitive data, such as credentials, and is not a best practice.