Google Professional Cloud DevOps Engineer Question 32
Select 3Google Cloud PlatformYour team is using a CI/CD pipeline in Google Cloud to automate application deployments. The pipeline uses a Git-based repository, Cloud Build, and deploys to Google Kubernetes Engine (GKE). During a recent security review, the team identified the need to prevent unauthorized access to sensitive information such as API keys and database credentials in the pipeline. What are the best practices to secure your CI/CD tooling in this scenario?
- A
Store sensitive credentials in Secret Manager and grant least privilege access to the pipeline service account.
- B
Embed sensitive credentials directly in the CI/CD pipeline configuration files to reduce complexity.
- C
Use Customer-Managed Encryption Keys (CMEK) for encrypting resources such as build artifacts and logs.
- D
Configure Cloud Build to run in a private pool with private network access to GKE.
- E
Enable Cloud Build triggers to automatically approve pull requests containing sensitive credentials.
Show answer and explanation
Correct answers: A, C, D
Explanation
To secure CI/CD tooling, it is critical to store and manage sensitive credentials securely using tools like Secret Manager. Leveraging Customer-Managed Encryption Keys (CMEK) adds an extra layer of security to encrypted resources, and using private pools for Cloud Build ensures restricted network access. These practices collectively reduce the risk of unauthorized access and data breaches in your CI/CD pipeline.
- A. Correct.
Storing sensitive credentials in Secret Manager ensures they are securely managed, and granting least privilege access minimizes the risk of unauthorized usage.
- B. Incorrect.
Embedding sensitive credentials directly in pipeline configuration files is a poor practice because it exposes them to accidental leaks or unauthorized access.
- C. Correct.
Using Customer-Managed Encryption Keys (CMEK) provides an additional layer of control and security over the encryption of build artifacts and logs.
- D. Correct.
Running Cloud Build in a private pool with private network access to GKE enhances security by restricting access to internal resources and limiting exposure to the public internet.
- E. Incorrect.
Automatically approving pull requests containing sensitive credentials is highly insecure and increases the risk of exposing sensitive information.