Examkin

Question

Difficulty: MediumContinuous Integration and Continuous Delivery (CI/CD) Pipeline Design

An enterprise organization is designing a Continuous Integration and Continuous Delivery (CI/CD) pipeline on Google Cloud to deploy microservices to Google Kubernetes Engine (GKE). Security governance mandates that build jobs must execute strictly within non-public network perimeters, and pipeline processes must authenticate to GCP resources without storing static, long-lived credentials or service account key files in code repositories. Which architecture strategy should the cloud architect choose to meet these security and pipeline requirements?

  1. Configure Cloud Build triggers using private worker pools peered with your VPC network, and authenticate the build execution using short-lived credentials managed via Workload Identity Federation and least-privilege IAM service accounts.Answer
  2. B
    Configure Cloud Build triggers to download JSON service account key files stored directly within the root of the application source code repository during the build step execution.
  3. C
    Configure default Cloud Build workers on public pools and assign the primitive Project Editor role to the default build service account to simplify resource provisioning across environments.
  4. D
    Assign the Service Account Admin role (roles/iam.serviceAccountAdmin) to developer identities so the build pipeline trigger can impersonate deployment service accounts.

Answer

Configure Cloud Build triggers using private worker pools peered with your VPC network, and authenticate the build execution using short-lived credentials managed via Workload Identity Federation and least-privilege IAM service accounts.
The correct strategy uses Cloud Build private worker pools peered with a VPC to satisfy private network perimeter constraints, combined with short-lived credentials via Workload Identity Federation or dedicated service accounts to avoid embedding permanent credentials or service account keys in repositories.

Step-by-Step Solution

1
Analyze network isolation requirements for the CI/CD pipeline environment.
Cloud Build default workers run in a shared multi-tenant environment with internet access. Private worker pools must be specified to run build jobs inside a private VPC environment.
Security policy explicitly requires build processes to execute within non-public network perimeters.
2
Evaluate authentication mechanism for build execution.
Workload Identity Federation or attached service accounts generate dynamic, short-lived tokens without requiring static key files.
Static JSON service account key files stored in code repositories pose significant security risks if leaked.
3
Select fine-grained IAM permissions for deployment tasks.
Assign predefined, least-privilege roles to the build service account rather than primitive roles or full service account management roles.
Ensures adherence to security governance and the principle of least privilege.

Key Concept

Secure CI/CD Pipeline Architecture with Cloud Build Private Pools and Workload Identity
Rate this question

Topics

Continuous Integration and Continuous Delivery (CI/CD) Pipeline Design

More questions from this topic