Examkin

Question

Difficulty: HardContinuous Integration and Continuous Delivery (CI/CD) Pipeline Design

An enterprise is designing a multi-project CI/CD pipeline on Google Cloud to deploy containerized microservices across staging and production environments. The security team mandates that container images built by Cloud Build in a shared build project must be verified for compliance using Binary Authorization attestations before release. Additionally, deployments to target Google Kubernetes Engine (GKE) clusters must support automated progressive delivery pipelines with mandatory manual approval gates for production targets, while strictly avoiding granting broad administrative permissions to build execution accounts. Which architectural solution satisfies these security and deployment requirements?

  1. Publish container images to Artifact Registry, use Cloud Key Management Service (Cloud KMS) to sign image attestations within Cloud Build for Binary Authorization, and deploy using Google Cloud Deploy pipelines configured with approval requirements for production GKE target promotion.Answer
  2. B
    Assign the primitive Editor role (roles/editor) to the default Cloud Build service account across all environment projects to allow it to push images to Artifact Registry and apply kubectl deployments directly to staging and production GKE clusters.
  3. C
    Grant the Cloud Build service account the Service Account Admin role (roles/iam.serviceAccountAdmin) so it can generate temporary keys to bypass private GKE control plane authorized network restrictions during automated deployments.
  4. D
    Configure Cloud Build to write deployment artifacts and pipeline states to standard single-region Cloud Storage buckets without versioning, relying exclusively on IAM roles rather than VPC Service Controls to prevent multi-project data exfiltration.

Answer

Publish container images to Artifact Registry, sign image attestations using Cloud KMS within Cloud Build for Binary Authorization validation, and orchestrate progressive release pipelines across GKE targets using Google Cloud Deploy with production approval gates.
The solution combining Artifact Registry for container management, Cloud KMS with Binary Authorization for supply chain security attestations, and Google Cloud Deploy for multi-target release management with approval gates fulfills all operational, security, and governance requirements under GCP architectural best practices.

Step-by-Step Solution

1
Analyze container build and artifact storage requirements.
Cloud Build compiles container images and publishes them to a centralized Artifact Registry repository in the shared services project.
Centralizing build artifacts in Artifact Registry provides enterprise governance, vulnerability scanning, and access control.
2
Implement software supply chain security controls.
Configure Cloud Build to generate digital signatures using Cloud KMS keys and store attestations in Container Analysis for Binary Authorization enforcement upon GKE cluster deployment.
Binary Authorization ensures that only trusted, verified container images meeting organizational policies can run on target GKE clusters.
3
Establish release orchestration with security gates.
Leverage Google Cloud Deploy to define delivery pipelines across staging and production GKE targets, enforcing required approval steps prior to production rollout.
Cloud Deploy decouples build execution from deployment orchestration, providing native promotion workflows and audit logs while adhering to least-privilege IAM models.

Key Concept

Enterprise CI/CD Pipeline Architecture with Cloud Build, Artifact Registry, Binary Authorization, and Google Cloud Deploy
Rate this question

Topics

Continuous Integration and Continuous Delivery (CI/CD) Pipeline Design

More questions from this topic