Your enterprise is deploying Google Cloud Workstations for a software development team requiring custom development tooling and internal security packages. You must establish a secure lifecycle and deployment workflow for these workstations that satisfies the following requirements: Workstation container images must automatically rebuild on a daily schedule to incorporate upstream base image security updates. Container images must reside in a private repository and undergo automated vulnerability scanning upon upload. Cloud Workstations must securely pull the private container images following least-privilege access control. Which combination of steps should you implement to satisfy these requirements?

Store the custom container image configuration in a connected Git repository. Create a Cloud Build trigger that builds and pushes the image to a private Artifact Registry repository with the Container Scanning API enabled. Schedule the build trigger daily using Cloud Scheduler, and configure the Workstation Configuration with a service account granted the Artifact Registry Reader role.: ### What the Solution Is This architecture establishes a fully automated, secure CI/CD lifecycle pipeline for **Cloud Workstations** custom container images utilizing native Google Cloud services: **Cloud Build**, **Artifact Registry**, **Artifact Analysis (Container Scanning)**, and **Cloud Scheduler**. ### How It Meets the Requirements - **Automated daily rebuilds**: A **Cloud Build** trigger connected to your source repository compiles the custom image. A **Cloud Scheduler** job invokes the Cloud Build trigger API endpoint on a cron schedule (`0 1 * * *`), ensuring that upstream base editor security updates are automatically pulled in daily. - **Private repository with vulnerability scanning**: Pushing the built image to a private **Artifact Registry** repository with the **Container Scanning API** (`containerscanning.googleapis.com`) enabled automatically triggers vulnerability scanning on each uploaded digest, identifying CVEs and severity levels. - **Secure image pulling with least privilege**: The **Cloud Workstation configuration** is configured with a dedicated runtime service account assigned the **Artifact Registry Reader** role (`roles/artifactregistry.reader`), granting the host VM permission to pull the private image without exposing broader permissions. ### Key Advantages - **Automated Security Patching**: Eliminates configuration drift and keeps container layers up to date with base patches. - **Integrated Vulnerability Management**: Artifact Analysis scans images continuously and surfaces package vulnerabilities directly in the console. - **Least-Privilege Enforcement**: Uses granular IAM roles on a dedicated service account attached to the workstation configuration. - **Native Integration**: Artifact Registry is the officially supported registry for Cloud Workstations custom container images. ### Why This Is Optimal This solution relies entirely on serverless, managed Google Cloud services without introducing operational overhead, third-party registry dependencies, or insecure long-lived service account keys.

Cloud Workstations Custom Container Lifecycle Pipeline | Professional Cloud DevOps Engineer

Cloud Workstations Custom Container Lifecycle Pipeline

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

Your enterprise is deploying Google Cloud Workstations for a software development team requiring custom development tooling and internal security packages. You must establish a secure lifecycle and deployment workflow for these workstations that satisfies the following requirements:

Workstation container images must automatically rebuild on a daily schedule to incorporate upstream base image security updates.
Container images must reside in a private repository and undergo automated vulnerability scanning upon upload.
Cloud Workstations must securely pull the private container images following least-privilege access control.

Which combination of steps should you implement to satisfy these requirements?

Create a Compute Engine VM to bake custom golden disk images daily using startup scripts. Export the disk images as compressed tar.gz archives to a Cloud Storage bucket, and configure the Workstation Configuration to boot from the Cloud Storage archive using the Storage Object Viewer role.

Store the custom container image configuration in a connected Git repository. Create a Cloud Build trigger that builds and pushes the image to a private Artifact Registry repository with the Container Scanning API enabled. Schedule the build trigger daily using Cloud Scheduler, and configure the Workstation Configuration with a service account granted the Artifact Registry Reader role.

Build custom container images manually using Docker on a local workstation, push the images to Artifact Registry, and grant the Project Owner role to the Cloud Workstations default service account to pull the images.

Publish the custom container images to a public Docker Hub repository using GitHub Actions. Configure Cloud Workstations to pull the public image directly using the default Compute Engine service account without enabling Container Scanning.

Professional Cloud DevOps Engineer

Cloud Workstations Custom Container Lifecycle Pipeline

Related questions