Google Professional Cloud DevOps Engineer Question 56
Select 3Google Cloud PlatformYou are a DevOps engineer for an organization that uses Google Cloud. Your team is migrating its build artifacts to Google Artifact Registry and wants to ensure the following:
- All build artifacts are stored securely.
- Only specific team members have access to deploy images from the registry.
- Automated CI/CD pipelines can push new images to the registry. Which of the following steps should you take to meet the requirements?
- A
Enable Artifact Registry API and create a repository in the required region.
- B
Grant the 'Artifact Registry Reader' role to the CI/CD pipeline service account.
- C
Configure IAM roles on the Artifact Registry repository to grant 'Artifact Registry Admin' to specific team members who deploy images.
- D
Use customer-managed encryption keys (CMEK) to encrypt artifacts stored in the Artifact Registry.
- E
Grant the 'Artifact Registry Writer' role to the CI/CD pipeline service account to push images.
Show answer and explanation
Correct answers: A, D, E
Explanation
To securely manage artifacts with Google Artifact Registry: (1) Enable the Artifact Registry API and create a repository to store artifacts. (2) Encrypt stored artifacts with CMEK for enhanced security. (3) Grant the 'Artifact Registry Writer' role to the CI/CD pipeline service account so it can push images. Avoid granting overly broad roles like 'Artifact Registry Admin' and ensure adherence to the principle of least privilege.
- A. Correct.
Correct: Enabling the Artifact Registry API and creating a repository is the first step to using Artifact Registry to store artifacts securely.
- B. Incorrect.
Incorrect: The 'Artifact Registry Reader' role only allows reading from the repository, which is insufficient for the CI/CD pipeline to push new images.
- C. Incorrect.
Incorrect: The 'Artifact Registry Admin' role is overly permissive and not aligned with the principle of least privilege. Specific deployment roles like 'Artifact Registry Reader' or 'Artifact Registry Writer' should be used.
- D. Correct.
Correct: Using customer-managed encryption keys (CMEK) provides an extra layer of security, ensuring artifacts are encrypted with keys managed by your organization.
- E. Correct.
Correct: The 'Artifact Registry Writer' role is necessary for the CI/CD pipeline service account to push images to the registry.