MENU
Your company is moving its continuous integration and delivery (CI/CD) pipeline to Compute Engine instances. The pipeline will manage the entire cloud infrastructure through code. How can you ensure that the pipeline has appropriate permissions while your system is following security best practices?
Suggested Answer: D
Get Premium Associate Cloud Engineer Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
Instance groups are collections of virtual machine (VM) instances that you can manage as a single entity. Instance groups can help you simplify the management of multiple instances, reduce operational costs, and improve the availability and performance of your applications. Instance groups support autoscaling, which automatically adds or removes instances from the group based on increases or decreases in load. Autoscaling helps your applications gracefully handle increases in traffic and reduces cost when the need for resources is lower. You can set the autoscaling policy based on CPU utilization, load balancing capacity, Cloud Monitoring metrics, or a queue-based workload. In this case, since the video encoding software is CPU-intensive, setting the autoscaling based on CPU utilization is the best option to ensure high availability and optimal performance.Reference:
Autoscaling groups of instances
34 comments · newest first
GE
Geoffrey
11 months ago
C is too permissive, better to limit access like in B.
ME
Melodie
11 months ago
Human approval in A is a good safety net!
ED
Edda
11 months ago
Surprised that people still use a single service account, isn’t that risky?
AR
Arlyne
11 months ago
I disagree, D seems more secure with multiple accounts.
TH
Theodora
12 months ago
Option B sounds solid, minimal rights are key!
RY
Ryan
12 months ago
I practiced a similar question where using a single service account was recommended, but I feel like option C might not be the best for security since it grants all permissions.
ER
Erasmo
1 year ago
I’m leaning towards option A because human approval adds an extra layer of security, but I wonder if it might slow down the pipeline too much.
CA
Casie
1 year ago
I think option D could be a good choice since it suggests creating multiple service accounts. It feels safer, but managing all those accounts might get complicated.
WI
Willard
1 year ago
I remember we discussed the importance of using minimal permissions for service accounts. Option B seems to align with that principle, but I'm not entirely sure about the impersonation part.
JO
Joni
1 year ago
Ugh, this is a tough one. I'm not sure if I fully understand the differences between the options. I think I'll need to review the material on IAM and service accounts again before I can make a decision.
MA
Marcelle
1 year ago
Hmm, I'm a bit confused by all the different options. I'll need to think this through carefully. Maybe I should start by understanding the security best practices that are mentioned in the question.
AR
Arlene
1 year ago
This seems like a tricky question, but I think the key is to find a way to give the pipeline the permissions it needs while still following security best practices. Option D looks promising with the use of multiple service accounts and a secret manager.
AS
Ashlyn
1 year ago
I feel pretty confident about this one. Option B looks like the best approach to me - using a single service account with minimal rights and allowing it to impersonate a user with elevated permissions. That way, the pipeline has the access it needs without giving it too much power.
RE
Rene
1 year ago
The language aspect could be really tough. Automated tools might struggle to handle data in multiple languages or with a lot of jargon and technical terms.
CH
Chaya
1 year ago
Hmm, I'm a bit unsure about this one. I know there are different types of testing, but I'm not totally clear on the differences between verification and validation testing. I'll have to think it through.
DO
Dorthy
1 year ago
Okay, let me think this through. Cgroups are used to limit and isolate the resources (CPU, memory, disk I/O, etc.) used by a container, so I'm guessing the correct answer is "No" since the solution doesn't seem to be describing that functionality.
KE
Kenneth
1 year ago
I heard they're also moving the coffee machine to the cloud. Should make for some interesting DevOps stories.
MA
Maryann
1 year ago
Hmm, Option A with human approval? Looks like someone's trying to get out of work. Let's just automate this whole thing and call it a day!
RU
Rutha
1 year ago
User 3: I agree with Rutha, automation is more efficient and less prone to errors.
KY
Kyoko
1 year ago
User 2: Kyoko, automation is the way to go! Let's streamline this process.
WH
Whitney
1 year ago
User 1: Option A with human approval? Looks like someone's trying to get out of work.
NA
Nan
1 year ago
Option D looks the most comprehensive to me. Using a secret manager to store the service account keys and allowing the pipeline to request the appropriate secrets is a smart way to manage permissions.
AI
Aileen
1 year ago
It's important to have a secure way to manage permissions in the CI/CD pipeline.
FI
Filiberto
1 year ago
I agree, using a secret manager for storing keys adds an extra layer of security.
LA
Lavonna
1 year ago
Option D looks the most comprehensive to me.
AM
Amalia
1 year ago
I'm not sure I agree with Option B. Wouldn't it be better to just give the service account all the required permissions instead of impersonating another user?
ST
Staci
1 year ago
Option B seems like the most secure approach. Impersonating a Cloud Identity user with elevated permissions is a great way to minimize the service account's rights.
CA
Cary
1 year ago
Having minimal rights and impersonation can help prevent unauthorized access.
NO
Nobuko
1 year ago
It's important to minimize the service account's rights for security.
WI
Wilda
1 year ago
Impersonating a Cloud Identity user with elevated permissions is a smart move.
PA
Pansy
1 year ago
I agree, option B does seem like a secure approach.
TA
Tamesha
2 years ago
That's a good point, Tammara. Option D does provide better security measures by using separate service accounts and secret management. It's important to prioritize security when setting up the pipeline.
TA
Tammara
2 years ago
I disagree, I believe option D is more secure. Creating multiple service accounts with minimal IAM permissions and using a secret manager service for key files adds an extra layer of security to the CI/CD pipeline.
TA
Tamesha
2 years ago
I think option B is the best choice. By attaching a single service account with minimal rights, we can ensure security while allowing the account to impersonate a Cloud Identity user with elevated permissions.