Examkin

Question

Difficulty: HardContinuous Integration and Continuous Delivery (CI/CD) Pipeline Design

A fintech organization is deploying compliance-critical payment processing microservices to Google Kubernetes Engine (GKE). The enterprise security team requires a zero-trust delivery pipeline that enforces container vulnerability scanning, cryptographic build provenance verification, binary authorization policy gates, and automated progressive rollout to prevent unvetted code from reaching production. Place the automated pipeline execution stages in the correct chronological sequence from source commit to production deployment.

  1. 1Cloud Build executes unit tests, compiles application binaries, builds the container image, and pushes the artifact to a private Artifact Registry repository.
  2. 2Container Analysis performs automated vulnerability scanning on the newly pushed container image and generates a cryptographically signed attestation stored in Container Analysis using Cloud KMS.
  3. 3Binary Authorization evaluates the container image against the organization's deployment policy by validating the presence of the signed attestation prior to allowing Cloud Deploy to create the release candidate.
  4. 4Cloud Deploy executes the delivery pipeline target sequence, deploying the release to a GKE canary deployment target for automated verification before completing full production rollout.

Answer

The correct sequence begins with Cloud Build building and pushing the container image to Artifact Registry, followed by Container Analysis vulnerability scanning and signing attestations via Cloud KMS, followed by Binary Authorization policy validation during release creation, and concludes with Cloud Deploy executing progressive canary rollout to GKE targets.
The pipeline flow strictly follows the software supply chain security lifecycle: code compilation and container build with Cloud Build pushing to Artifact Registry, vulnerability scanning with Container Analysis to produce KMS-signed attestations, pre-deployment policy verification via Binary Authorization, and finally progressive canary release management using Cloud Deploy.

Step-by-Step Solution

1
Build and Artifact Storage
Container image created and stored in private Artifact Registry.
Source code compilation and container image creation must precede security auditing and deployment stages.
2
Vulnerability Scanning and Attestation
Container Analysis scans the image and signs an attestation using Cloud KMS keys.
Cryptographic attestations must be generated based on successful security scanning results before admission control policies can be evaluated.
3
Admission Control Gate Enforcement
Binary Authorization verifies required signatures and grants release creation.
Policy validation must occur prior to rendering delivery manifests or deploying workloads to Kubernetes clusters.
4
Progressive CD Delivery Execution
Cloud Deploy manages canary deployment and automated promotion to production GKE clusters.
Progressive traffic allocation and target deployments represent the final operational phase of the pipeline.

Key Concept

Secure CI/CD Pipeline Design with Container Attestations, Binary Authorization, and Cloud Deploy
Rate this question

Topics

Continuous Integration and Continuous Delivery (CI/CD) Pipeline Design

More questions from this topic