Discuss Linux Foundation CNPA Exam Topic 3 Question 2

In the context of platform engineering and the effective delivery of platform software, which of the following statements describes the role of CI/CD pipelines in relation to Software Bill of Materials (SBOM) and security scanning?

ASBOM generation and security scanning are particularly valuable for application software. While platform software may have different security considerations, these practices are highly beneficial within CI/CD pipelines for applications.

BCI/CD pipelines should integrate SBOM generation and security scanning as automated steps within the build and test phases to ensure early detection of vulnerabilities and maintain a clear inventory of components.

CCI/CD pipelines are designed to accelerate the delivery of platform software, and adding SBOM generation and security scanning would slow down the process, so these activities are better suited for periodic audits conducted outside of the pipeline.

DCI/CD pipelines are primarily for automating deployments; SBOM generation and security scanning are separate, manual processes performed after deployment.

Suggested Answer: B

Modern platform engineering requires security and compliance to be integral parts of the delivery process, not afterthoughts. CI/CD pipelines are the foundation for delivering platform software rapidly and reliably, and integrating SBOM generation and automated vulnerability scanning directly within pipelines ensures that risks are identified early in the lifecycle.

Option B is correct because it reflects recommended practices from cloud native platform engineering standards: SBOMs provide a transparent inventory of all software components, including dependencies, which is crucial for vulnerability management, license compliance, and supply chain security. By automating these steps in CI/CD, teams can maintain both velocity and security without manual overhead.

Option A downplays the relevance of SBOMs for platform software, which is inaccurate because platform components (like Kubernetes operators, ingress controllers, or logging agents) are equally susceptible to vulnerabilities. Option C dismisses automation in favor of periodic audits, which contradicts the shift-left security principle. Option D misunderstands CI/CD's purpose: security must be integrated, not separated.

--- CNCF Supply Chain Security Whitepaper

--- CNCF Platforms Whitepaper

--- Cloud Native Platform Engineering Study Guide

Get Premium CNPA Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

13 comments · newest first

Stephen 11 months ago

A makes sense, but platform software still needs attention.

Pearlie 11 months ago

I disagree with C. Security can't be an afterthought!

Cordelia 11 months ago

Wait, D sounds off. Manual processes after deployment? Really?

Glendora 11 months ago

Totally agree with B! Automation is the way to go.

Christiane 11 months ago

B is spot on! Early detection is key.

Kerrie 12 months ago

I have a nagging feeling that option C is a common misconception; slowing down the pipeline for security checks seems counterproductive.

Annita 12 months ago

I practiced a question similar to this, and I think the idea of automating security checks in the pipeline is crucial, which points me towards option B again.

Gerald 1 year ago

I'm not entirely sure, but I feel like option A might be downplaying the importance of SBOM for platform software.

Kiley 1 year ago

I remember discussing how CI/CD pipelines should ideally integrate security practices, so I think option B makes the most sense.

Karl 1 year ago

I'm leaning towards option B. Automating those security checks within the pipeline seems like a smart way to ensure the platform software is secure and the components are well-documented.

Joni 1 year ago

Option C seems reasonable to me. Slowing down the pipeline with extra steps could be problematic. Maybe those activities are better suited for separate audits.

Veda 1 year ago

I'm a bit confused by the question. Aren't CI/CD pipelines just for automating deployments? I'm not sure how SBOM and security scanning fit in there.

Marget 1 year ago

I think option B sounds like the best approach. Integrating SBOM and security scanning into the CI/CD pipeline makes a lot of sense to catch issues early.

Linux Foundation CNPA Exam - Topic 3 Question 2 Discussion