A team wants to improve their software supply chain security. They decide to use the SLSA framework. What does SLSA provide to help them?

A set of security levels that guide incremental improvements.

A compliance certification for software products.

A list of approved software vendors.

A tool that automatically signs all software artifacts.

A company wants to enforce separation of duties between developers and operators. Which IAM approach best supports this?

Give operators the Owner role and developers the Editor role.

Use a single service account for all deployments.

Grant developers and operators the same roles to simplify management.

Create distinct roles for developers (e.g., deploy to dev) and operators (e.g., manage production), and assign them to the appropriate groups.

What is the purpose of generating provenance for a software artifact?

To reduce the size of the artifact.

To encrypt the artifact so only authorized users can access it.

To provide a verifiable record of how the artifact was built and where it came from.

A DevOps engineer runs a vulnerability scan on a container image using Artifact Analysis. The scan completes and reports a finding with a severity of 'HIGH' and a CVSS score of 8.5. What does this finding indicate about the image?

The image is safe to deploy because the vulnerability is not exploitable.

The image is compliant with all security policies and can be promoted to production.

The image contains a package with a known vulnerability that could pose a security risk.

The image has been signed by a trusted authority and is verified.

What is the primary purpose of the SLSA framework?

To provide a set of standards for building container images.

To automate the deployment of software to production.

To assess and improve the security of the software supply chain.

To scan source code for vulnerabilities.

Google CloudProfessional Cloud DevOps Engineer

Domain 2Objective 4

2.4 Securing the Deployment Pipeline PROFESSIONAL-CLOUD-DEVOPS-ENGINEER Practice Questions (Page 2)

Part of the Section 2: Building and implementing CI/CD pipelines, including continuous testing, for application, infrastructure, and machine learning workloads domain, which accounts for ~25% of the exam of the PROFESSIONAL-CLOUD-DEVOPS-ENGINEER exam.

15questions here

3free pages

7concepts

~25% of the examof the exam

Questions 6–10

6foundation · easy
A team wants to improve their software supply chain security. They decide to use the SLSA framework. What does SLSA provide to help them?
Select an answer first
7foundation · easy
A company wants to enforce separation of duties between developers and operators. Which IAM approach best supports this?
Select an answer first
8foundation · easy
What is the purpose of generating provenance for a software artifact?
Select an answer first
9foundation · easy
A DevOps engineer runs a vulnerability scan on a container image using Artifact Analysis. The scan completes and reports a finding with a severity of 'HIGH' and a CVSS score of 8.5. What does this finding indicate about the image?
Select an answer first
10foundation · easy
What is the primary purpose of the SLSA framework?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to PROFESSIONAL-CLOUD-DEVOPS-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Google Cloud. “PROFESSIONAL-CLOUD-DEVOPS-ENGINEER” is a trademark of its owner, used for identification only.