Cloud Native Applications and CI/CD Pipelines GCPN Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   What is a common best practice for injecting secrets into a CI/CD pipeline at runtime?

   • AWriting the secret directly into the pipeline's YAML file
   • BIncluding the secret in the Docker image as an environment variable
   • CUsing environment variables that are referenced from a secure vault
   • DPassing the secret as a command-line argument to every step
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A company's CI/CD pipeline deploys a healthcare application that must comply with data privacy regulations. The compliance team requires that all access to the production environment be logged and that the logs be tamper-evident. The pipeline uses a service account to deploy to production. What is the most effective way to meet the tamper-evident logging requirement?

   • AStore the logs in the CI/CD platform's built-in log viewer and rely on the platform's access controls.
   • BSend the logs to a separate logging service that is accessible to all developers for transparency.
   • CEncrypt the logs with a key held by the security team and store them in a standard storage service.
   • DStream the pipeline logs and production access logs to a write-once-read-many (WORM) storage service that prevents modification or deletion.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which practice is a key security best practice for configuring CI/CD pipelines?

   • ADisabling logging to reduce noise
   • BUsing separate environments for development, testing, and production
   • CGranting all developers admin access to the pipeline
   • DStoring all secrets in the pipeline configuration file
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A development team uses a CI/CD pipeline to deploy a web application. The pipeline needs to authenticate to a cloud provider to provision infrastructure. The team currently stores the cloud provider's API key as a plaintext variable in the CI/CD platform's project settings. A security review flags this as a risk. What is the most secure way to manage this credential?

   • AAsk developers to copy the API key into the pipeline script each time a deployment is needed.
   • BStore the API key in a file in the application's source code repository and reference it during the pipeline run.
   • CMove the API key to a dedicated secrets management service and have the pipeline retrieve it dynamically at runtime using the CI/CD platform's native integration.
   • DEncrypt the API key with a hardcoded encryption key in the pipeline script and store the encrypted value as a CI/CD variable.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A DevOps team is building a CI/CD pipeline for a containerized application. The security team requires that no container image with known critical vulnerabilities is deployed to production. The pipeline currently builds the image, runs unit tests, and deploys to production. What is the most effective way to integrate container security scanning into this pipeline?

   • AUse a runtime security tool that monitors the container in production and alerts on suspicious behavior.
   • BScan the base image used in the Dockerfile before the build starts, but do not scan the final image.
   • CRun a vulnerability scan on the production container registry once a week and report any critical findings to the security team.
   • DAdd a container image vulnerability scan step after the image is built and before the deployment step, and fail the pipeline if critical vulnerabilities are found.
   Reveal Solution Discussion Select an answer first