Google Professional Cloud DevOps Engineer Question 202
Select 3Google Cloud PlatformYou are tasked with setting up a secure cloud development environment for your engineering team on Google Cloud. The environment must ensure that developers only have access to the resources they need, sensitive data is protected during development, and the code is scanned for vulnerabilities before deployment. Which of the following should you implement to meet these requirements?
- A
Use IAM roles with the principle of least privilege to restrict developer access to only necessary resources.
- B
Implement a Cloud DLP (Data Loss Prevention) service to monitor and secure sensitive data in the development environment.
- C
Require developers to use personal Google Cloud accounts for accessing the development environment to ensure accountability.
- D
Integrate a CI/CD pipeline that includes automated vulnerability scanning tools.
- E
Store sensitive credentials and API keys directly in the source code repository for quick access during development.
Show answer and explanation
Correct answers: A, B, D
Explanation
To enable a secure cloud development environment, it's essential to apply the principle of least privilege, protect sensitive data, and proactively identify code vulnerabilities. IAM roles ensure resource access is restricted, Cloud DLP secures sensitive information, and vulnerability scanning helps catch issues early. Using personal accounts or storing sensitive credentials in source code repositories poses significant security risks and should be avoided.
- A. Correct.
Correct: Applying the principle of least privilege ensures that developers only have access to the resources they need, reducing the risk of unauthorized access or misuse.
- B. Correct.
Correct: Using Cloud DLP helps protect sensitive data by scanning and securing it, which is critical in a secure cloud development environment.
- C. Incorrect.
Incorrect: Using personal accounts introduces security and accountability risks. Instead, developers should use managed accounts within the organization's domain.
- D. Correct.
Correct: Including automated vulnerability scanning in the CI/CD pipeline helps identify and remediate code vulnerabilities before deployment.
- E. Incorrect.
Incorrect: Storing sensitive credentials and API keys in the source code repository is a security risk. These should be stored securely using tools like Secret Manager.