Your enterprise data engineering team is designing a CI/CD pipeline in Google Cloud to automate the promotion of Dataflow batch processing pipelines and Cloud Composer DAGs from a development project to a production project. The deployment pipeline must satisfy several security and governance constraints: Container images for custom Dataflow flex templates must be validated for vulnerabilities prior to deployment. Production cloud services must be isolated within a VPC Service Controls perimeter. CI/CD execution identities must adhere to the principle of least privilege without granting internal Google-managed service agent roles to deployment service accounts. Which CI/CD and Infrastructure as Code (IaC) promotion strategy should you implement?

Configure Cloud Build triggers in the CI/CD pipeline using a dedicated user-managed service account. Store custom container images in Artifact Registry with automatic vulnerability scanning enabled via Container Analysis, enforce deployment gates using Binary Authorization before pushing to production, and include the Container Security API and data services within the VPC Service Controls perimeter.: ### What the Recommended Architecture Is This architecture establishes an automated, secure **CI/CD deployment and promotion pipeline** using **Cloud Build**, **Artifact Registry**, **Container Analysis**, **Binary Authorization**, and **VPC Service Controls**. It manages the transition of containerized Dataflow jobs and Cloud Composer orchestration assets from development into a protected production boundary while strictly enforcing policy-as-code and vulnerability mitigation. ### How It Meets the Security and Promotion Requirements - **Automated Vulnerability Scanning**: Custom container images pushed to **Artifact Registry** are automatically evaluated by **Container Analysis** / **Container Scanning Service Agent** for known CVEs. Binary Authorization inspects these attestations before orchestrating image deployment into production. - **Network Boundary Protection**: The production environment is wrapped inside a **VPC Service Controls** perimeter that includes services such as the **Container Security API** (`containersecurity.googleapis.com`), Dataflow, and Cloud Storage, mitigating unauthorized external data exfiltration. - **Least-Privilege Identity Management**: The pipeline executes using a dedicated, user-managed **Cloud Build service account** tailored with granular IAM roles rather than abusing internal Google-managed service agent roles. ### Key Advantages and Capabilities - **Automated Governance Gates**: Enforces cryptographic provenance and security attestation checks automatically in the promotion path. - **Repeatable Infrastructure Promotion**: Works seamlessly with Infrastructure as Code (**IaC**) tools such as Terraform across multi-project environments. - **Perimeter Integration**: Fully compatible with VPC Service Controls perimeters across all supported analytics and container security APIs. - **Separation of Duties**: Isolate development experimentation from production releases through automated gate enforcement. ### Why This Is Optimal This approach provides an end-to-end automated promotion pipeline that enforces automated vulnerability validation, strict network boundaries, and granular IAM permissions without creating administrative bypasses or misusing internal service agents.

Promote Dataflow Composer Cicd Vpcsc | professional-cloud-data-engineer

Promote Dataflow Composer Cicd Vpcsc

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

Your enterprise data engineering team is designing a CI/CD pipeline in Google Cloud to automate the promotion of Dataflow batch processing pipelines and Cloud Composer DAGs from a development project to a production project.

The deployment pipeline must satisfy several security and governance constraints:

Container images for custom Dataflow flex templates must be validated for vulnerabilities prior to deployment.
Production cloud services must be isolated within a VPC Service Controls perimeter.
CI/CD execution identities must adhere to the principle of least privilege without granting internal Google-managed service agent roles to deployment service accounts.

Which CI/CD and Infrastructure as Code (IaC) promotion strategy should you implement?

Grant the Dataflow Service Agent role (roles/dataflow.serviceAgent) and Composer API Service Agent role (roles/composer.serviceAgent) to the CI/CD service account so it can deploy resources across projects, while skipping VPC Service Controls perimeters.

Configure Cloud Build triggers in the CI/CD pipeline using a dedicated user-managed service account. Store custom container images in Artifact Registry with automatic vulnerability scanning enabled via Container Analysis, enforce deployment gates using Binary Authorization before pushing to production, and include the Container Security API and data services within the VPC Service Controls perimeter.

Execute continuous deployment scripts using the Compute Engine default service account, deploy Dataflow worker templates directly from public container registries, and apply OS config policies to inspect images after deployment.

Assign the predefined Cloud Build Service Agent role (roles/cloudbuild.serviceAgent) directly to a custom build worker service account, run security scans inside build scripts using local Docker CLI daemon scanners, and deploy directly into the production VPC perimeter without enabling Container Analysis.

Professional Cloud Data Engineer

Promote Dataflow Composer Cicd Vpcsc

Related questions