Google Professional Cloud DevOps Engineer Question 86
Select 3Google Cloud PlatformYou are designing a CI/CD pipeline for a financial services application deployed on Google Cloud. Security is a top priority due to compliance requirements. Which of the following measures should you implement to secure the CI/CD deployment pipeline?
- A
Use IAM roles with the principle of least privilege for the pipeline's service accounts.
- B
Store sensitive environment variables directly in the source code repository for easy access.
- C
Enable binary authorization to enforce deployment of only verified container images.
- D
Use a private Container Registry instead of a public one to store build artifacts.
- E
Allow developers to execute arbitrary scripts directly in the production environment for faster debugging.
Show answer and explanation
Correct answers: A, C, D
Explanation
Securing the CI/CD pipeline involves implementing practices such as least privilege access control, verifying build artifacts, and restricting access to sensitive resources. Options 1, 3, and 4 directly contribute to securing the pipeline. Options 2 and 5 introduce security vulnerabilities and should be avoided.
- A. Correct.
Using IAM roles with the principle of least privilege ensures that the CI/CD pipeline components only have the minimum permissions required to operate, reducing the risk of unauthorized access or privilege escalation.
- B. Incorrect.
Storing sensitive environment variables in the source code repository is a security risk as it exposes them to unauthorized users who may gain access to the repository.
- C. Correct.
Enabling binary authorization ensures that only trusted and verified container images are deployed to production, enhancing security by preventing unverified or tampered images from being used.
- D. Correct.
Using a private Container Registry restricts access to build artifacts and reduces the risk of unauthorized access compared to using a public registry.
- E. Incorrect.
Allowing developers to execute arbitrary scripts directly in the production environment introduces significant security risks and bypasses established security controls.