Google Professional Cloud DevOps Engineer Question 46
Select 3Google Cloud PlatformYour team is developing a new application on Google Cloud and plans to use Cloud Build for CI/CD pipelines. To ensure secure development practices, you want to restrict access to production secrets and enforce security policies during the build process. Which of the following measures should you implement to enable a secure cloud development environment?
- A
Use Secret Manager to store sensitive information and restrict access with IAM roles.
- B
Run all build steps with elevated permissions to ensure pipeline success.
- C
Enable Binary Authorization to enforce deployment policies for container images.
- D
Use a custom service account with minimal permissions for Cloud Build execution.
- E
Store sensitive environment variables directly in the source code repository for easier access.
Show answer and explanation
Correct answers: A, C, D
Explanation
To enable a secure cloud development environment on Google Cloud, it is critical to manage sensitive information securely (e.g., using Secret Manager), restrict permissions (e.g., by using minimal-permission service accounts), and enforce security policies (e.g., through Binary Authorization). These practices help mitigate risks such as unauthorized access, privilege escalation, and deployment of untrusted artifacts. Avoid actions that expose sensitive data, such as storing secrets in source code or using elevated permissions unnecessarily.
- A. Correct.
Correct: Secret Manager is a secure way to store and manage sensitive information. Using IAM roles ensures access is restricted to authorized users and services.
- B. Incorrect.
Incorrect: Running build steps with elevated permissions increases the risk of accidental or malicious actions. Principles of least privilege should always be applied.
- C. Correct.
Correct: Binary Authorization ensures that only trusted and verified container images are deployed, adding a layer of security to your CI/CD pipeline.
- D. Correct.
Correct: Using a custom service account with minimal permissions adheres to the principle of least privilege, reducing the attack surface if the service account is compromised.
- E. Incorrect.
Incorrect: Storing sensitive environment variables in the source code repository is a security risk, as it exposes secrets to unauthorized access if the repository is compromised.