Google Professional Cloud Security Engineer Question 382
Select 3Google Cloud PlatformYour organization has implemented Google Cloud for hosting its workloads. To enhance security and ensure consistency, you want to automate infrastructure and application security by using Infrastructure as Code (IaC). Which of the following practices should you follow to achieve this?
- A
Use a version-controlled repository to store and manage your IaC templates.
- B
Hardcode sensitive secrets, such as API keys and passwords, directly in your IaC templates for simplicity.
- C
Integrate your IaC pipeline with a security scanning tool to identify vulnerabilities in templates before deployment.
- D
Manually review each IaC template for security issues before every deployment.
- E
Implement role-based access control (RBAC) for the CI/CD pipeline managing your IaC deployments.
Show answer and explanation
Correct answers: A, C, E
Explanation
To automate infrastructure and application security effectively, it is important to follow best practices such as using a version-controlled repository for IaC, integrating with security scanning tools for automated vulnerability detection, and implementing RBAC to secure the deployment pipeline. Avoid practices such as hardcoding sensitive information or relying solely on manual reviews, as they can introduce significant security risks and hinder automation.
- A. Correct.
Using a version-controlled repository for IaC allows for proper change tracking, auditability, and collaboration, which are critical for maintaining secure infrastructure.
- B. Incorrect.
Hardcoding sensitive secrets in IaC templates is a bad practice as it exposes them to unauthorized access. Instead, use secret management tools like Google Secret Manager.
- C. Correct.
Integrating IaC pipelines with security scanning tools ensures that potential vulnerabilities in templates are identified and mitigated before they are deployed.
- D. Incorrect.
While manual reviews can be helpful, they are not scalable or sufficient for consistent security automation. Automated tools are more effective for identifying issues systematically.
- E. Correct.
Implementing RBAC for CI/CD pipelines ensures that only authorized users or services can make changes to IaC deployments, reducing the risk of unauthorized access or modifications.