Examkin

Question

Difficulty: Very hardAnalyzing Software Development Lifecycle (SDLC) and CI/CD Pipelines

An enterprise organization is restructuring its software delivery lifecycle to establish an end-to-end secure, automated CI/CD pipeline for deploying a critical microservice to Google Kubernetes Engine (GKE). The security policy mandates least-privilege access, container vulnerability scanning, cryptographic image attestation using Binary Authorization, Terraform state validation, and controlled canary traffic routing. Place the operational stages of this deployment pipeline in the correct chronological order from initial source submission to full production release.

  1. 1Cloud Build executes static analysis, builds the container image, triggers an automated vulnerability scan via Artifact Analysis, and blocks execution if critical security vulnerabilities are detected.
  2. 2Upon successful vulnerability scanning, Cloud Build uses a Cloud KMS key pair to generate a cryptographic attestation for the image digest, uploading both the image and signature to Artifact Registry.
  3. 3Cloud Build authenticates via Workload Identity Federation using a dedicated user-managed service account to execute a speculative `terraform plan` for environment validation against the remote GCS state backend.
  4. 4Cloud Deploy releases the attested container image to GKE, where the Binary Authorization policy verifies the KMS attestation signature before deploying a canary release receiving 10% of live production traffic.
  5. 5Automated Cloud Monitoring metrics evaluate error budgets and latency SLIs over a 15-minute window before Cloud Deploy promotes the release to 100% production traffic.

Answer

The correct operational sequence begins with Cloud Build compiling the container image and performing static security and vulnerability analysis via Artifact Analysis. Once validated, Cloud Build uses Cloud KMS to generate a cryptographic Binary Authorization attestation and pushes the image and signature to Artifact Registry. Next, Cloud Build uses Workload Identity Federation with a dedicated user-managed service account to validate infrastructure state via `terraform plan`. Cloud Deploy then initiates deployment to GKE, where Binary Authorization verifies the KMS signature before establishing a 10% canary traffic allocation. Finally, Cloud Monitoring evaluates canary stability metrics against defined Service Level Indicators (SLIs) before Cloud Deploy automatically promotes the release to 100% production traffic.
The sequence follows Google Cloud best practices for secure SDLC and progressive delivery. Artifact vulnerability scanning must precede attestation signing so that only clean images receive KMS signatures. Infrastructure state validation via Terraform and Workload Identity Federation ensures environment readiness. GKE Binary Authorization enforces the signature requirement at cluster admission during Cloud Deploy canary launch. Finally, canary health observation against Cloud Monitoring SLIs ensures automated, risk-managed full promotion.

Step-by-Step Solution

1
Perform initial artifact construction and security scanning.
Container image built and checked for vulnerabilities via Container Analysis prior to artifact signing.
Security checks must run immediately at artifact creation to prevent compromised code from proceeding further into the pipeline.
2
Sign the validated container image and push to Artifact Registry.
A cryptographic attestation linked to Cloud KMS is produced and stored along with the container image.
Binary Authorization policies require a verified attestation signature tied to a compliant image digest before cluster admission.
3
Validate infrastructure state changes.
Terraform plans are generated against remote GCS backends using short-lived credentials via Workload Identity Federation.
Least-privilege service account authentication ensures infrastructure drift and state lock checks complete securely before deployment.
4
Trigger canary deployment under admission policy control.
GKE Binary Authorization validates the KMS signature and Cloud Deploy routes 10% of live traffic to the canary workloads.
Admission control prevents unauthorized container execution while canary deployment minimizes blast radius for new code.
5
Evaluate canary health metrics and complete production promotion.
Cloud Monitoring confirms error budget integrity and SLI health, triggering 100% traffic rollout.
Automated metrics verification ensures production stability before full rollout.

Key Concept

Continuous Integration and Continuous Delivery (CI/CD) Pipeline Analysis
Rate this question

Topics

Analyzing Software Development Lifecycle (SDLC) and CI/CD Pipelines