Google Professional Cloud DevOps Engineer Question 31
Select 3Google Cloud PlatformYour organization uses a CI/CD pipeline built on Google Cloud to deploy production workloads. A recent security audit revealed vulnerabilities in the CI/CD tooling, including unauthorized access to sensitive credentials and unverified third-party code execution. What steps should you take to improve the security of your CI/CD pipeline?
- A
Store sensitive credentials in a secure secret management solution, such as Google Secret Manager, and control access via IAM roles.
- B
Use an isolated service account with minimal permissions for the CI/CD pipeline to interact with Google Cloud resources.
- C
Allow developers to directly modify pipeline configuration files for faster iteration.
- D
Implement signed container images and enforce verification of image signatures before deployment.
- E
Disable audit logging for the CI/CD tools to reduce operational overhead.
Show answer and explanation
Correct answers: A, B, D
Explanation
Securing a CI/CD pipeline requires a combination of best practices, such as protecting sensitive credentials, minimizing permissions through isolated service accounts, and verifying the integrity of artifacts like container images. These measures reduce the risk of unauthorized access, unverified code execution, and misconfigurations. Avoid practices that introduce vulnerabilities, such as bypassing audit logging or allowing ungoverned modifications to pipeline configurations.
- A. Correct.
Storing sensitive credentials in a secure secret management solution, such as Google Secret Manager, ensures that credentials are encrypted and access is controlled through IAM policies, reducing the risk of unauthorized access.
- B. Correct.
Using an isolated service account with minimal permissions follows the principle of least privilege, ensuring the CI/CD pipeline can only perform permitted actions, reducing the attack surface.
- C. Incorrect.
Allowing developers to directly modify pipeline configuration files introduces potential risks, such as accidental misconfigurations or malicious changes, which can compromise security.
- D. Correct.
Implementing signed container images and enforcing signature verification ensures that only trusted and verified images are deployed, reducing the risk of executing unauthorized or malicious code.
- E. Incorrect.
Disabling audit logging removes critical visibility into pipeline activities, hindering your ability to detect and respond to security incidents, which is not recommended.