Examkin

Question

Difficulty: MediumAnalyzing Software Development Lifecycle (SDLC) and CI/CD Pipelines

A financial technology company is analyzing its continuous integration and continuous delivery (CI/CD) deployment pipeline for security vulnerabilities and process reliability. Currently, developers run manual deployment scripts using personal credentials, leading to configuration drift and security risks. The cloud architecture team must transition the deployment process to Google Cloud native automation while enforcing least privilege and securing infrastructure state files. Which pipeline design best addresses these requirements?

  1. Configure Cloud Build to authenticate via Workload Identity Federation, execute builds using a dedicated user-managed service account with least privilege permissions, and persist state in a Cloud Storage bucket with object versioning enabled.Answer
  2. B
    Grant the default Cloud Build service account the primitive Project Owner role to streamline deployment across all resources, and maintain the state file locally within the short-lived build container workspace.
  3. C
    Generate long-lived JSON service account keys for build authentication, store them in the source repository, and grant developers the Service Account Admin role to manage execution identity.
  4. D
    Allow developers to make manual configuration adjustments through the Cloud Console during pipeline runs, storing state files on individual local machines prior to deployment.

Answer

Configure Cloud Build to authenticate via Workload Identity Federation, execute builds using a dedicated user-managed service account with least privilege permissions, and persist state in a Cloud Storage bucket with object versioning enabled.
Configuring Cloud Build to use Workload Identity Federation replaces static service account keys with short-lived tokens, eliminating credential leak risks. Executing builds using a custom user-managed service account enforces least privilege. Persisting infrastructure state in Cloud Storage with object versioning secures state files against loss, corruption, and concurrency issues.

Step-by-Step Solution

1
Analyze security authentication requirements for CI/CD pipelines.
Identify that Workload Identity Federation avoids long-lived service account keys.
Short-lived tokens reduce credential theft risks from repository integration points.
2
Evaluate execution identity and permissions model.
Assign a dedicated user-managed service account with fine-grained roles.
Avoids over-privileged access like primitive Owner roles or unnecessary admin rights.
3
Determine persistent state management best practices.
Use Cloud Storage with object versioning and locking.
Prevents state file loss, configuration drift, and concurrent execution corruption.

Key Concept

Secure CI/CD Pipeline Design and IaC State Governance
Rate this question

Topics

Analyzing Software Development Lifecycle (SDLC) and CI/CD Pipelines