Google Professional Cloud DevOps Engineer Question 77
Select 3Google Cloud PlatformYou are managing a CI/CD pipeline for a production application deployed on Google Cloud. The pipeline requires access to sensitive API keys and database credentials. Which of the following are best practices for securely managing these secrets in your CI/CD pipeline?
- A
Store the secrets in plaintext within the CI/CD pipeline configuration files.
- B
Use Google Secret Manager to securely store and retrieve secrets during pipeline execution.
- C
Encrypt the secrets with a strong encryption key and store the encryption key in the same CI/CD configuration file for easy access.
- D
Restrict access to secrets using IAM roles and permissions to limit who or what can retrieve them.
- E
Pass secrets to the pipeline through environment variables dynamically configured at runtime.
Show answer and explanation
Correct answers: B, D, E
Explanation
Best practices for managing secrets in a CI/CD pipeline include using a secure secrets management solution like Google Secret Manager, implementing access control with IAM roles and permissions, and passing secrets dynamically at runtime to avoid storing them in plaintext or in insecure locations. These practices help ensure the confidentiality and integrity of sensitive information throughout the pipeline.
- A. Incorrect.
Storing secrets in plaintext within CI/CD pipeline configuration files is a security risk, as anyone with access to the configuration files can view the secrets. This is not a best practice.
- B. Correct.
Using Google Secret Manager is a secure and recommended approach for managing secrets. It allows you to store, version, and control access to sensitive information.
- C. Incorrect.
Encrypting secrets is a good practice, but storing the encryption key in the same location as the secrets defeats the purpose of encryption and poses a significant security risk.
- D. Correct.
Restricting access to secrets using IAM roles and permissions ensures that only authorized users or services can retrieve and use the secrets, following the principle of least privilege.
- E. Correct.
Passing secrets to the pipeline through environment variables dynamically at runtime ensures that secrets are not hardcoded or stored within the pipeline configuration, reducing the risk of unauthorized access.