Cloud Native Applications and CI/CD Pipelines GCPN Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A DevOps team is using a CI/CD platform that supports encrypted environment variables. The team needs to pass a database password to a deployment job. What is the most secure way to handle this?

   • AUse the platform's encrypted environment variables and reference them in the job.
   • BAsk a developer to enter the password manually during each deployment.
   • CStore the password in a text file in the repository and read it during the job.
   • DHardcode the password in the deployment script.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A software company builds a container image for a new microservice. The pipeline pulls a base image from a public registry, installs dependencies, and pushes the final image to a private registry. The security team wants to ensure that the final image has not been tampered with and that its origin can be verified. What should the pipeline do?

   • ARun a vulnerability scan on the final image and record the scan report in the pipeline logs.
   • BStore the final image in a private registry and rely on the registry's access controls to prevent unauthorized modifications.
   • CSign the final image with a private key held by the CI/CD system and store the corresponding public key for verification at deployment time.
   • DUse a checksum of the base image to verify its integrity after pulling, but do not sign the final image.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A fintech company deploys a containerized microservices application to a managed Kubernetes cluster. The compliance team requires that every deployment be attributable to a specific human approver and that the full promotion history from build to production be reconstructable for auditors. The platform team is designing the CI/CD pipeline. Which pipeline design best satisfies the compliance requirement?

   • AImplement separate build, staging, and production pipeline stages with a mandatory manual approval step before production, and record the approver's identity in the pipeline run metadata.
   • BUse a single pipeline that builds, tests, and deploys directly to production, with the build server's service account as the deployment identity.
   • CAutomate the entire pipeline with no manual gates, but enable verbose logging on the Kubernetes cluster to capture all API calls.
   • DRequire developers to run the production deployment command manually from their local machines using their personal credentials.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company is designing a cloud native application that consists of several microservices. The team wants to deploy the application to a managed Kubernetes cluster. The security team requires that the application be resilient to failures and that the deployment process be automated. Which combination of features best meets these requirements?

   • AUse Kubernetes Deployments for stateless microservices and StatefulSets for stateful services, with a CI/CD pipeline that applies the manifests and performs rolling updates.
   • BUse a single Deployment for all microservices and rely on the CI/CD pipeline to manage the application's lifecycle.
   • CUse Kubernetes Jobs for all microservices and run them on a schedule.
   • DUse a Kubernetes DaemonSet to run all microservices on every node.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company uses Terraform to manage its cloud infrastructure. The security team wants to ensure that the infrastructure does not drift from the approved configuration and that any unauthorized changes are detected. What is the most effective control to implement?

   • AStore the Terraform state file in a shared location and rely on the state file to reflect the current infrastructure.
   • BRun a periodic 'terraform plan' in the CI/CD pipeline and compare the output to the last known good state, failing the pipeline if drift is detected.
   • CUse a cloud provider's native configuration monitoring service to detect changes to resources.
   • DRequire all infrastructure changes to be made through the CI/CD pipeline and disable direct access to the cloud provider console.
   Reveal Solution Discussion Select an answer first