Examkin

Soru

Zorluk: ZorAnalyzing Software Development Lifecycle (SDLC) and CI/CD Pipelines

An enterprise logistics company is refactoring its automated software supply chain on Google Cloud. The architecture team requires a zero-trust CI/CD pipeline where deployment to Google Kubernetes Engine (GKE) is strictly gated by vulnerability analysis and cryptographic attestations via Binary Authorization. Arrange the pipeline stages in the correct execution order from initial source repository trigger to final cluster deployment.

  1. 1Cloud Build executes a container build triggered by a code commit and pushes the compiled artifact to Google Artifact Registry.
  2. 2Container Analysis performs automated vulnerability scanning on the newly pushed container image digest in Artifact Registry.
  3. 3Cloud Build executes a pipeline step using a dedicated attestor identity and Cloud KMS key to generate an attestation proving vulnerability checks passed.
  4. 4Cloud Deploy triggers target deployment to GKE, where Binary Authorization verifies the signature of the Cloud KMS attestation prior to container instantiation.

Cevap

The correct pipeline sequence begins with Cloud Build compiling and pushing the container image to Artifact Registry, followed by Container Analysis vulnerability scanning, followed by Cloud KMS attestation generation via Binary Authorization attestor credentials, and concludes with Cloud Deploy pushing to GKE where Binary Authorization enforces signature verification.
The proper end-to-end SDLC order follows the logical security boundary of building, scanning, signing, and deploying. First, code build creates an image digest in Artifact Registry. Second, Container Analysis evaluates the stored digest. Third, an attestor signs the validation result via Cloud KMS. Fourth, Cloud Deploy and GKE Binary Authorization validate the signature at admission time.

Adım Adım Çözüm

1
Identify the artifact creation phase
Cloud Build receives the repository trigger, builds the application container image, and pushes it to Artifact Registry to create an immutable image reference.
Security analysis and deployment targets require a central, immutable container digest stored in Artifact Registry before any validation can take place.
2
Analyze security compliance and vulnerability scanning
Container Analysis scans the image digest stored in Artifact Registry for CVEs and vulnerability compliance.
Attestations cannot be generated until the image is scanned and verified clean of blocking vulnerabilities.
3
Generate cryptographic attestation
Cloud Build uses an authorized attestor service account to sign an attestation payload using a Cloud KMS asymmetric key.
Attestations serve as digital signatures certifying that the build and scan pipeline stages completed successfully.
4
Enforce deployment policy gating
Cloud Deploy initiates deployment to GKE, where the GKE Binary Authorization admission controller verifies the cryptographic attestation signature before allowing pod creation.
Enforcement occurs at runtime admission; GKE blocks any container image deployment lacking valid attestations signed by the designated Cloud KMS key.

Anahtar Kavram

Software Supply Chain Security & CI/CD Gating with Binary Authorization
Bu soruyu puanla

Konular

Analyzing Software Development Lifecycle (SDLC) and CI/CD Pipelines