Google Professional Cloud DevOps Engineer Question 90
Select 3Google Cloud PlatformYour organization is adopting the SLSA (Supply-chain Levels for Software Artifacts) framework to improve software supply chain security. As a DevOps engineer, you are tasked with ensuring the security of container images deployed to Google Kubernetes Engine (GKE). Which steps should you take to align with SLSA Level 2 requirements and secure your software supply chain?
- A
Implement Binary Authorization to enforce deployment of only trusted container images to GKE.
- B
Ensure all build processes are reproducible and use community-contributed open-source scripts without modification.
- C
Adopt a build pipeline that generates provenance metadata for all container images.
- D
Sign container images cryptographically and verify the signatures before deployment.
- E
Use an unmanaged CI/CD system to allow developers to make rapid changes directly in production.
Show answer and explanation
Correct answers: A, C, D
Explanation
To align with SLSA Level 2 requirements, it is essential to enforce the deployment of trusted artifacts (e.g., via Binary Authorization), generate provenance metadata during the build process, and cryptographically sign and verify container images. These measures ensure the integrity and authenticity of the software supply chain, reducing the risk of introducing compromised artifacts into production. Using unmanaged systems or unverified scripts does not comply with these security practices and increases the attack surface.
- A. Correct.
Implementing Binary Authorization ensures that only trusted, verified container images are deployed to your GKE clusters, which aligns with SLSA's focus on improving supply chain security.
- B. Incorrect.
While reproducible builds are ideal for higher SLSA levels, relying on unverified community-contributed scripts without modification does not meet SLSA Level 2 requirements, as they may introduce security vulnerabilities.
- C. Correct.
Generating provenance metadata is a key requirement for SLSA Level 2, as it helps track the origin and build process of artifacts to ensure their integrity.
- D. Correct.
Cryptographically signing container images and verifying signatures before deployment ensures that only verified artifacts are used, aligning with SLSA's emphasis on artifact integrity and authenticity.
- E. Incorrect.
Using an unmanaged CI/CD system with rapid changes to production disregards security best practices and does not align with SLSA, as it introduces risks to the software supply chain.