Google Professional Cloud DevOps Engineer Question 222
Select 3Google Cloud PlatformYour organization is implementing a CI/CD pipeline on Google Cloud. To secure the pipeline, you want to ensure that only verified code is deployed to production and that sensitive credentials used during deployment are not exposed. Which of the following actions should you take to meet these requirements?
- A
Use a code signing mechanism to verify and validate the source code before deployment.
- B
Store sensitive credentials in a secure environment such as Secret Manager and access them programmatically during deployment.
- C
Allow developers to embed sensitive credentials directly in the source code repository for quick access.
- D
Implement IAM policies to restrict deployment permissions to specific service accounts or teams.
- E
Disable logging during deployment to prevent sensitive information from being exposed in logs.
Show answer and explanation
Correct answers: A, B, D
Explanation
Securing the CI/CD pipeline is essential to protect the integrity of the deployment process and sensitive data. By using a code signing mechanism, securely storing credentials in Secret Manager, and implementing IAM policies, you can significantly improve the security of your pipeline. Avoid practices like embedding credentials in source code or disabling logging, as they introduce security vulnerabilities and operational challenges.
- A. Correct.
Using a code signing mechanism ensures that only verified and trusted code is deployed, reducing the risk of unauthorized or malicious code being introduced into production.
- B. Correct.
Storing sensitive credentials in a secure environment such as Secret Manager ensures that they are not exposed in the codebase and are accessed securely during deployment.
- C. Incorrect.
Embedding sensitive credentials directly in the source code repository is a security risk as it exposes them to unauthorized access and potential leaks.
- D. Correct.
Restricting deployment permissions using IAM policies ensures that only authorized accounts or teams can perform deployments, reducing the risk of unauthorized changes.
- E. Incorrect.
Disabling logging during deployment is not a best practice, as it can hinder debugging and monitoring. Instead, sensitive information should be redacted or excluded from logs.