Examkin

Question

Difficulty: MediumAnalyzing Software Development Lifecycle (SDLC) and CI/CD Pipelines

An organization is establishing an automated, secure continuous integration and continuous delivery (CI/CD) pipeline on Google Cloud to deploy containerized applications to Google Kubernetes Engine (GKE). Arrange the following pipeline execution stages in the correct sequence from developer code commit to final production verification.

  1. 1Cloud Build is triggered automatically via a repository webhook upon code commit to run unit tests.
  2. 2Artifact Analysis scans the container image for vulnerability CVEs before it is stored in Artifact Registry.
  3. 3Cloud Build executes Terraform to validate state and update GKE cluster manifests stored in a Google Cloud Storage backend.
  4. 4Cloud Deploy initiates a automated deployment to the staging GKE cluster and performs automated integration testing.
  5. 5Cloud Deploy promotes the validated release to the production GKE cluster and monitors Cloud Monitoring health metrics.

Answer

The correct chronological sequence for the CI/CD pipeline is: 1) Trigger Cloud Build via repository webhook on code commit, 2) Perform vulnerability scanning with Artifact Analysis before pushing to Artifact Registry, 3) Validate and execute Terraform IaC manifests against GKE, 4) Deploy to staging environment via Cloud Deploy for integration testing, and 5) Promote the release to production via Cloud Deploy with Cloud Monitoring verification.
The sequence follows Google Cloud SDLC best practices: Source trigger -> Build & Security scanning -> Infrastructure/Manifest update -> Staging deployment & testing -> Production promotion & health monitoring.

Step-by-Step Solution

1
Identify the entry point of the continuous integration process.
Code commit triggers the Cloud Build pipeline via webhooks to run unit tests.
CI/CD execution begins at the source control stage.
2
Determine the secure build and artifact generation step.
Images are scanned by Artifact Analysis for vulnerability checks prior to repository storage.
Security shift-left requires scanning artifacts before storing or using them.
3
Locate the infrastructure and environment configuration phase.
Terraform state is checked and GKE manifest changes are applied.
Infrastructure and deployment manifests must be updated with new image tags prior to application deployment.
4
Identify non-production deployment and testing.
Cloud Deploy deploys the application to the staging GKE cluster.
Applications must undergo integration tests in staging before reaching production.
5
Determine the final release promotion step.
Cloud Deploy promotes the build to production while monitoring health indicators.
Production promotion is the final phase of continuous delivery.

Key Concept

Continuous Integration and Continuous Delivery (CI/CD) Pipeline Sequencing and Security
Rate this question

Topics

Analyzing Software Development Lifecycle (SDLC) and CI/CD Pipelines