You are configuring your CI/CD pipeline natively on Google Cloud. You want builds in a pre- production Google Kubernetes Engine (GKE) environment to be automatically load-tested before being…

Question

Options

• ACreate an attestation for the builds that pass the load test by requiring the lead quality assurance
• BCreate an attestation for the builds that pass the load test by using a private key stored in Cloud
• CCreate an attestation for the builds that pass the load test by using a private key stored in Cloud
• DCreate an attestation for the builds that pass the load test by requiring the lead quality assurance

• A
  5% (1)
• B
  5% (1)
• C
  82% (18)
• D
  9% (2)

Explanation

In a Binary Authorization pipeline, attestations prove that a specific build step (here, the load test) was completed successfully. The Google-recommended approach is to use an asymmetric key pair stored in Cloud KMS to sign attestations programmatically and automatically after the load test passes. Cloud KMS provides secure, audited key management without manual key handling. Options A and D require a human (lead QA engineer) to manually sign off, introducing a manual bottleneck and defeating the purpose of automated CI/CD. The key distinction between B and C is the security of where the private key is stored - Cloud KMS is the recommended, secure option.

No community discussion yet for this question.