Google Professional Cloud DevOps Engineer Question 85
Select 3Google Cloud PlatformYour team is building a CI/CD pipeline for deploying containerized applications to Google Kubernetes Engine (GKE). To meet security best practices, you need to ensure the pipeline is protected against unauthorized access and tampering. Which steps should you take to secure the CI/CD pipeline?
- A
Use IAM roles to restrict access to the CI/CD pipeline resources based on the principle of least privilege.
- B
Store environment variables, such as API keys and database credentials, in plaintext within the pipeline configuration files for easy access.
- C
Enable binary authorization to ensure only trusted container images are deployed to GKE.
- D
Use signed Git commits to verify the integrity and authenticity of code changes in the pipeline.
- E
Allow public access to the CI/CD pipeline logs for better visibility and transparency.
Show answer and explanation
Correct answers: A, C, D
Explanation
Securing a CI/CD pipeline involves implementing multiple layers of protection to prevent unauthorized access and ensure the integrity of the deployment process. Using IAM roles, enabling binary authorization, and leveraging signed Git commits are essential measures to protect your pipeline. Avoid storing sensitive information in plaintext and exposing logs publicly, as these practices can introduce significant security risks.
- A. Correct.
Using IAM roles to enforce the principle of least privilege limits access to only those who need it, reducing the risk of unauthorized actions.
- B. Incorrect.
Storing sensitive data like environment variables in plaintext is a security risk as it can easily expose them to unauthorized users. Instead, use secret management tools like Secret Manager.
- C. Correct.
Binary authorization ensures that only container images that meet specific security policies are deployed, protecting against untrusted or vulnerable images.
- D. Correct.
Signed Git commits add a layer of trust by verifying the origin and integrity of changes made to the codebase, preventing tampering.
- E. Incorrect.
Allowing public access to CI/CD logs increases the risk of exposing sensitive information and makes the pipeline vulnerable to attacks.