An enterprise organization is designing an artifact management strategy in Google Cloud Artifact Registry for their automated CI/CD pipelines. The build pipelines consume proprietary internal packages as well as external upstream dependencies across multiple language ecosystems (e.g., Maven, npm, Python). The DevOps team must meet the following requirements: Provide developers and CI/CD runners with a single, unified endpoint URL for resolving dependencies. Mitigate dependency confusion risks by strictly prioritizing internal packages over external third-party packages. Cache third-party dependencies locally within Google Cloud to improve build speed, reduce external egress, and protect against upstream outages. Direct pipeline write and publish operations exclusively to the appropriate internal package store, as aggregated upstream endpoints are read-only. Which repository architecture and configuration in Artifact Registry should the DevOps engineer implement?

Create Standard repositories for proprietary build artifacts, create Remote repositories to proxy and cache public upstream registries, and create a Virtual repository that aggregates both with the Standard repository configured with higher upstream priority; configure CI/CD pipelines to read from the Virtual repository and publish new releases directly to the Standard repository.: ### What this solution is In **Google Cloud Artifact Registry**, repository hierarchies can be designed by combining **Standard repositories**, **Remote repositories**, and **Virtual repositories**: - **Standard repositories** act as direct, writable storage for internally developed packages, container images, and build outputs. - **Remote repositories** act as caching pull-through proxies for public upstream sources (such as Maven Central, npmjs, PyPI, or Docker Hub). - **Virtual repositories** serve as a single logical access point that combines multiple upstream repositories (both Standard and Remote) into an indexed search hierarchy. ### How it meets the requirements - **Single unified endpoint**: The **Virtual repository** exposes a single configuration URL for dependency managers (e.g., Maven, npm, pip), consolidating multiple backing stores behind one endpoint. - **Mitigate dependency confusion**: In the **Virtual repository** configuration, administrators assign **priority policies** to upstream policies. Giving the **Standard repository** higher priority ensures that package resolution searches private internal packages first, neutralizing dependency substitution attacks. - **Dependency caching**: The underlying **Remote repository** fetches requested external packages on-demand, stores them in Google Cloud, and delivers them from cache for all subsequent builds, lowering latency and avoiding upstream rate limits. - **Publish operations**: Because Virtual repositories are read-only search indices, CI/CD pipelines configure their publish tasks to push newly built artifacts directly to the **Standard repository**. ### Key advantages and capabilities - **Optimized pipeline build latency**: Build runners pull cached dependencies across Google's high-speed regional backbone. - **Enhanced supply chain security**: Centralizes vulnerability scanning and policy enforcement across internal and cached external artifacts. - **Zero disruption to developer workflows**: Developers and CI/CD tools configure a single repository URL in their local package configuration files (`.npmrc`, `settings.xml`, `pip.conf`). - **Deterministic builds**: Protects pipelines from upstream registry downtime or removed public packages by retaining cached dependencies. ### Why this is optimal This pattern represents Google Cloud's recommended best practice for artifact management. It cleanly separates writable proprietary artifact storage from caching proxies while providing unified, policy-governed read access.

Artifact Registry Virtual Remote Standard Repository Hierarchy | Professional Cloud DevOps Engineer

Artifact Registry Virtual Remote Standard Repository Hierarchy

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise organization is designing an artifact management strategy in Google Cloud Artifact Registry for their automated CI/CD pipelines. The build pipelines consume proprietary internal packages as well as external upstream dependencies across multiple language ecosystems (e.g., Maven, npm, Python).

The DevOps team must meet the following requirements:

Provide developers and CI/CD runners with a single, unified endpoint URL for resolving dependencies.
Mitigate dependency confusion risks by strictly prioritizing internal packages over external third-party packages.
Cache third-party dependencies locally within Google Cloud to improve build speed, reduce external egress, and protect against upstream outages.
Direct pipeline write and publish operations exclusively to the appropriate internal package store, as aggregated upstream endpoints are read-only.

Which repository architecture and configuration in Artifact Registry should the DevOps engineer implement?

Create Standard repositories for proprietary build artifacts, create Remote repositories to proxy and cache public upstream registries, and create a Virtual repository that aggregates both with the Standard repository configured with higher upstream priority; configure CI/CD pipelines to read from the Virtual repository and publish new releases directly to the Standard repository.

Create a Virtual repository with write-through caching enabled to capture internal artifacts, and attach a Remote repository that falls back to downstream Standard repositories for secondary resolution.

Create a Remote repository configured with write permissions for CI/CD builds to store all proprietary packages, and create regional Standard repositories configured as read-only mirrors of the Remote repository.

Create a single multi-regional Standard repository to hold both private artifacts and external dependencies, and configure CI/CD pipeline build scripts to pull missing external dependencies directly over the public internet and push them into the Standard repository before compiling.

Professional Cloud DevOps Engineer

Artifact Registry Virtual Remote Standard Repository Hierarchy

Related questions