An organization is designing a CI/CD pipeline on Google Cloud to build container images securely and manage release artifacts. Which of the following practices should be incorporated into the pipeline design? (Select TWO answers.)
- Use Cloud Build with a dedicated service account configured with least-privilege IAM roles for build execution.Cevap
- Store built container images in Artifact Registry to enable granular access control and automated container vulnerability scanning.Cevap
- CGrant the primitive Owner role to the Cloud Build default service account to prevent permission errors during deployment steps.
- DRely exclusively on IAM permissions without configuring VPC Service Controls to prevent pipeline artifacts from being copied to external storage buckets.
Cevap
The pipeline design should utilize Cloud Build with a dedicated service account configured with least-privilege IAM permissions, and store container images in Artifact Registry to leverage granular access management and automated vulnerability scanning.
Establishing dedicated service accounts with minimal necessary IAM permissions for Cloud Build ensures secure build execution. Storing artifacts in Artifact Registry allows organizations to enforce repository-level access policy and scan images automatically for security vulnerabilities.
Adım Adım Çözüm
Anahtar Kavram
Least-privilege execution and secure artifact management in CI/CD pipelines