Examkin

Soru

Zorluk: ZorContinuous Integration and Continuous Delivery (CI/CD) Pipeline Design

A healthtech platform processes sensitive patient data across hybrid environments and is designing a deployment pipeline using Google Cloud native services. The pipeline must deploy containerized microservices to multiple private Google Kubernetes Engine (GKE) clusters across staging and production environments. The enterprise architecture board mandates strict data exfiltration prevention during the build phase and strict privilege separation so build workers cannot directly deploy workloads or alter cluster infrastructure. Which TWO architectural configurations should the team implement to satisfy these requirements? (Select TWO.)

  1. Execute Cloud Build jobs inside a Cloud Build Private Pool integrated with a VPC Service Controls security perimeter, granting the build service account minimal permissions to write artifacts to Artifact Registry.Cevap
  2. Decouple delivery by utilizing Cloud Deploy pipelines where target service accounts manage cluster rollouts, ensuring Cloud Build lacks direct IAM credentials to administer the target GKE clusters.Cevap
  3. C
    Grant the Cloud Build service account the Service Account Admin role (`roles/iam.serviceAccountAdmin`) over the deployment identity so build workers can dynamically generate keys for cluster authentication.
  4. D
    Rely exclusively on Cloud IAM conditional bindings and Artifact Registry repository policy constraints to prevent build containers from exfiltrating source code to external registries without using VPC Service Controls.

Cevap

The team should execute Cloud Build jobs in Private Pools within a VPC Service Controls perimeter while restricting artifact permissions, and use Cloud Deploy to separate release creation from GKE deployment execution privileges.
The correct strategy combines network isolation during compilation with role separation during deployment. Executing builds inside Cloud Build Private Pools attached to a VPC Service Controls perimeter blocks egress data exfiltration routes. Separating build tasks from deployment execution via Cloud Deploy ensures that build triggers do not maintain administrative privileges over private GKE clusters.

Adım Adım Çözüm

1
Analyze build phase network security and data exfiltration constraints.
Standard Cloud Build runs on multi-tenant worker pools with default internet egress. Utilizing Cloud Build Private Pools peered into a VPC protected by VPC Service Controls prevents outbound exfiltration.
VPC Service Controls establishes a network perimeter around Google Cloud resources that IAM alone cannot enforce.
2
Establish separation of duties between Continuous Integration (CI) and Continuous Delivery (CD).
Delegating deployment orchestration to Cloud Deploy prevents Cloud Build from needing administrative cluster credentials or direct access to private GKE control planes.
Principle of least privilege requires that container image build tools cannot directly modify production workload states.

Anahtar Kavram

Secure CI/CD Pipeline Design with Cloud Build Private Pools, VPC Service Controls, and Cloud Deploy
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Continuous Integration and Continuous Delivery (CI/CD) Pipeline Design

Bu konudan daha fazla soru