Cloud Native Applications and CI/CD Pipelines GCPN Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the primary security benefit of using Infrastructure as Code (IaC) to provision cloud resources?

   • AIt allows for consistent and repeatable deployments that can be reviewed for security
   • BIt makes all resources publicly accessible for easier management
   • CIt eliminates the need for security monitoring
   • DIt automatically encrypts all data at rest
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A regulated company must provide evidence to an auditor that its CI/CD pipeline is secure and compliant. The auditor requires proof that all changes are reviewed and that the pipeline is protected against unauthorized access. Which evidence should the company provide?

   • AAudit logs showing all pipeline activities, including who initiated builds and who approved changes.
   • BA list of all pipeline administrators and their roles.
   • CA security policy document describing the pipeline's security controls.
   • DA vulnerability scan report from the last quarter.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company has separate CI/CD pipelines for development, staging, and production environments. The production pipeline uses a service account with full administrative access to the production cloud environment. The security team wants to reduce the risk of a compromised development pipeline affecting production. What is the most effective control to implement?

   • AShare the same service account across all pipelines to simplify credential management.
   • BUse a separate, least-privilege service account for the production pipeline that only has permissions to deploy the specific application, and ensure the development pipeline cannot access it.
   • CUse a service account with full administrative access for the production pipeline to ensure deployments are never blocked by permission issues.
   • DStore the production service account key in the development pipeline's secret store for easy access.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A DevOps engineer is configuring a CI/CD pipeline for a cloud-native application. The pipeline must build a container image, run unit tests, and deploy to a staging environment. The engineer needs to ensure that the pipeline uses the principle of least privilege and that secrets are not exposed in logs. Which two actions should the engineer take?

   • AUse a service account with broad administrative permissions and store secrets in the pipeline configuration file.
   • BUse the developer's personal credentials for the pipeline and store secrets in plain text in the repository for easy access.
   • CUse a service account with read-only access to the repository and store secrets in a shared team document.
   • DUse a dedicated service account with only the permissions required for the build and deploy stages, and store secrets in a vault that injects them as environment variables at runtime.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company's CI/CD pipeline builds a container image using a base image from a public registry. The security team wants to ensure that the base image is trustworthy and has not been tampered with. The team is considering several controls. Which control provides the strongest guarantee of the base image's integrity and origin?

   • AVerify the base image's digital signature using the publisher's public key before pulling it into the build.
   • BUse a checksum of the base image that is published on the registry's website.
   • CTrust the base image because it is from a well-known public registry.
   • DRun a vulnerability scan on the base image after pulling it.
   Reveal Solution Discussion Select an answer first