2.4 Securing the Deployment Pipeline PROFESSIONAL-CLOUD-DEVOPS-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11expert · medium

   A company is adopting SLSA and wants to achieve Level 2 for their build process. They currently use a developer's local machine to build and sign container images. What is the minimum change they must make to meet SLSA Level 2?

   • AMove the build process to a hosted CI/CD service like Cloud Build and generate provenance for the build.
   • BAdd a manual approval step before the image is pushed to the registry.
   • CUse a hardware security module (HSM) to store the signing key.
   • DEnable Binary Authorization on the production cluster to require signed images.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   A company wants to ensure that only container images signed by their CI/CD system can be deployed to production. Which Google Cloud service should they use?

   • ACloud Build
   • BBinary Authorization
   • CArtifact Registry
   • DCloud IAM
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   A DevOps team is designing IAM policies for different environments (dev, staging, prod). What is the key principle they should follow?

   • AGrant the same permissions to all environments for consistency.
   • BGrant the most permissions to production to ensure availability.
   • CGrant broader permissions in dev and progressively restrict access in staging and prod.
   • DUse the same service account for all environments to simplify management.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the purpose of separation of duties in IAM role design?

   • ATo make it easier for developers to access all resources.
   • BTo ensure that all team members have the same permissions.
   • CTo reduce the risk of unauthorized actions by requiring multiple people to complete critical tasks.
   • DTo speed up the deployment process.
   Reveal Solution Discussion Select an answer first
6. 15expert · medium

   A company wants to achieve SLSA Level 3 for their software supply chain. They currently have a CI/CD pipeline that builds container images and stores them in Artifact Registry. They have already implemented provenance generation and signed artifacts. What additional requirement must they meet to achieve SLSA Level 3?

   • AEnsure the build runs on a hosted, ephemeral environment that is isolated from other builds and has no access to the developer's local machine.
   • BAdd a manual approval step in the pipeline before the image is promoted to production.
   • CRun vulnerability scans on all images and fail the build if any critical vulnerability is found.
   • DUse a cryptographic key stored in a hardware security module (HSM) to sign all artifacts.
   Reveal Solution Discussion Select an answer first