Your enterprise organization is designing a continuous integration and continuous delivery (CI/CD) pipeline architecture on Google Cloud to build and deploy critical applications. The security governance team mandates strict compliance with the following security requirements: Least-privilege execution: Builds must run using dedicated identities with fine-grained IAM permissions tailored strictly to the required pipeline tasks, avoiding broad default service account privileges. Network perimeter and isolation: Pipeline execution environments must be completely isolated from the public internet, hosted in a private Virtual Private Cloud (VPC) network, and contained within a VPC Service Controls (VPC-SC) security perimeter to prevent source code and artifact exfiltration. Secure secret access: Sensitive API keys and deployment credentials must be securely consumed dynamically during pipeline execution without storing long-lived service account keys in repositories or persisting secrets in build configuration files. Which architecture and configuration strategy should the DevOps team implement?

Provision Cloud Build private worker pools peered with a dedicated VPC network inside the VPC Service Controls perimeter, assign a custom user-managed service account with targeted IAM roles to the build trigger, and retrieve secrets dynamically at execution time using native Secret Manager integration.: ### What Cloud Build Private Pools and Granular Security Controls Are **Cloud Build private pools** provide fully managed, isolated worker machines that run within a customer-controlled virtual network. When combined with custom **user-managed service accounts**, **VPC Service Controls (VPC-SC)**, and **Secret Manager**, they establish an enterprise-grade, zero-trust continuous integration and deployment pipeline. ### How It Meets the Requirements - **Least-privilege execution**: Assigning a dedicated user-managed service account directly to Cloud Build triggers replaces the overly permissive default Cloud Build service account. Specific, granular roles (such as `roles/secretmanager.secretAccessor` and `roles/artifactregistry.writer`) ensure the pipeline only accesses authorized resources. - **Network perimeter and isolation**: Private worker pools execute within private worker networks peered with your VPC network. Placing these resources inside a **VPC Service Controls service perimeter** prevents data exfiltration by restricting API communication strictly to authorized perimeter boundaries. - **Secure secret access**: Cloud Build integrates natively with **Secret Manager** using the `availableSecrets` configuration stanza. Secrets are injected dynamically into individual build steps as environment variables or mounted files without exposing sensitive plaintext tokens in configuration files or code repositories. ### Key Advantages and Capabilities - **No public internet exposure**: Worker nodes have no external IP addresses and access Google APIs via Private Google Access. - **Supply chain protection**: Enforces boundaries against malicious dependency fetching and unauthorized artifact uploads. - **Centralized audit logging**: Every secret access and build execution event is logged in Cloud Audit Logs. - **Zero long-lived key risks**: Eliminates the operational and security hazards associated with static downloadable service account keys. ### Why This Is Optimal This architecture adheres completely to Google Cloud security best practices by uniting network-layer isolation (VPC-SC), identity-layer boundaries (user-managed service accounts with IAM least privilege), and dynamic secret management.

Cloud Build Least Privilege Vpc Sc Secret Manager | Professional Cloud DevOps Engineer

Cloud Build Least Privilege Vpc Sc Secret Manager

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

Your enterprise organization is designing a continuous integration and continuous delivery (CI/CD) pipeline architecture on Google Cloud to build and deploy critical applications. The security governance team mandates strict compliance with the following security requirements:

Least-privilege execution: Builds must run using dedicated identities with fine-grained IAM permissions tailored strictly to the required pipeline tasks, avoiding broad default service account privileges.
Network perimeter and isolation: Pipeline execution environments must be completely isolated from the public internet, hosted in a private Virtual Private Cloud (VPC) network, and contained within a VPC Service Controls (VPC-SC) security perimeter to prevent source code and artifact exfiltration.
Secure secret access: Sensitive API keys and deployment credentials must be securely consumed dynamically during pipeline execution without storing long-lived service account keys in repositories or persisting secrets in build configuration files.

Which architecture and configuration strategy should the DevOps team implement?

Configure Cloud Build private worker pools with external public IP addresses enabled, grant the Owner role to the Cloud Build service account, and store encrypted credentials in Cloud Storage buckets accessed via public URLs.

Provision Cloud Build private worker pools peered with a dedicated VPC network inside the VPC Service Controls perimeter, assign a custom user-managed service account with targeted IAM roles to the build trigger, and retrieve secrets dynamically at execution time using native Secret Manager integration.

Generate static JSON service account keys with Project Editor privileges, export them into GitHub Actions runners hosted on public Compute Engine virtual machines, and download secrets using startup scripts.

Execute builds on the default shared Cloud Build worker pool using the default Cloud Build service account with the Cloud Build Editor role, and pass sensitive credentials as plaintext environment variables within the cloudbuild.yaml file.

Professional Cloud DevOps Engineer

Cloud Build Least Privilege Vpc Sc Secret Manager

Related questions