Your enterprise organization is designing a continuous integration and continuous delivery (CI/CD) pipeline architecture on Google Cloud to build and deploy critical applications. The security governance team mandates strict compliance with the following security requirements: Least-privilege execution: Builds must run using dedicated identities with fine-grained IAM permissions tailored strictly to the required pipeline tasks, avoiding broad default service account privileges. Network perimeter and isolation: Pipeline execution environments must be completely isolated from the public internet, hosted in a private Virtual Private Cloud (VPC) network, and contained within a VPC Service Controls (VPC-SC) security perimeter to prevent source code and artifact exfiltration. Secure secret access: Sensitive API keys and deployment credentials must be securely consumed dynamically during pipeline execution without storing long-lived service account keys in repositories or persisting secrets in build configuration files. Which architecture and configuration strategy should the DevOps team implement?

Provision Cloud Build private worker pools peered with a dedicated VPC network inside the VPC Service Controls perimeter, assign a custom user-managed service account with targeted IAM roles to the build trigger, and retrieve secrets dynamically at execution time using native Secret Manager integration.: What Cloud Build Private Pools and Granular Security Controls Are Cloud Build private pools provide fully managed, isolated worker machines that run within a customer-controlled virtual network. When combined with custom user-managed service accounts, VPC Service Controls (VPC-SC), and Secret Manager, they establish an enterprise-grade, zero-trust continuous integration and deployment pipeline. How It Meets the Requirements Least-privilege execution: Assigning a dedicated user-managed service account directly to Cloud Build triggers replaces the overly permissive default Cloud Build service account. Specific, granular roles (such as roles/secretmanager.secretAccessor and roles/artifactregistry.writer) ensure the pipeline only accesses authorized resources. Network perimeter and isolation: Private worker pools execute within private worker networks peered with your VPC network. Placing these resources inside a VPC Service Controls service perimeter prevents data exfiltration by restricting API communication strictly to authorized perimeter boundaries. Secure secret access: Cloud Build integrates natively with Secret Manager using the availableSecrets configuration stanza. Secrets are injected dynamically into individual build steps as environment variables or mounted files without exposing sensitive plaintext tokens in configuration files or code repositories. Key Advantages and Capabilities No public internet exposure: Worker nodes have no external IP addresses and access Google APIs via Private Google Access. Supply chain protection: Enforces boundaries against malicious dependency fetching and unauthorized artifact uploads. Centralized audit logging: Every secret access and build execution event is logged in Cloud Audit Logs. Zero long-lived key risks: Eliminates the operational and security hazards associated with static downloadable service account keys. Why This Is Optimal This architecture adheres completely to Google Cloud security best practices by uniting network-layer isolation (VPC-SC), identity-layer boundaries (user-managed service accounts with IAM least privilege), and dynamic secret management.

StudyCerts

Professional Cloud DevOps Engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Cloud Build Least Privilege Vpc Sc Secret Manager

Section: Security of CI/CD tooling

Your enterprise organization is designing a continuous integration and continuous delivery (CI/CD) pipeline architecture on Google Cloud to build and deploy critical applications. The security governance team mandates strict compliance with the following security requirements:

Least-privilege execution: Builds must run using dedicated identities with fine-grained IAM permissions tailored strictly to the required pipeline tasks, avoiding broad default service account privileges.
Network perimeter and isolation: Pipeline execution environments must be completely isolated from the public internet, hosted in a private Virtual Private Cloud (VPC) network, and contained within a VPC Service Controls (VPC-SC) security perimeter to prevent source code and artifact exfiltration.
Secure secret access: Sensitive API keys and deployment credentials must be securely consumed dynamically during pipeline execution without storing long-lived service account keys in repositories or persisting secrets in build configuration files.

Which architecture and configuration strategy should the DevOps team implement?

Provision Cloud Build private worker pools peered with a dedicated VPC network inside the VPC Service Controls perimeter, assign a custom user-managed service account with targeted IAM roles to the build trigger, and retrieve secrets dynamically at execution time using native Secret Manager integration.

Configure Cloud Build private worker pools with external public IP addresses enabled, grant the Owner role to the Cloud Build service account, and store encrypted credentials in Cloud Storage buckets accessed via public URLs.

Execute builds on the default shared Cloud Build worker pool using the default Cloud Build service account with the Cloud Build Editor role, and pass sensitive credentials as plaintext environment variables within the cloudbuild.yaml file.

Generate static JSON service account keys with Project Editor privileges, export them into GitHub Actions runners hosted on public Compute Engine virtual machines, and download secrets using startup scripts.

Professional Cloud DevOps Engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Cloud Build Least Privilege Vpc Sc Secret Manager

Section: Security of CI/CD tooling

Least-privilege execution: Builds must run using dedicated identities with fine-grained IAM permissions tailored strictly to the required pipeline tasks, avoiding broad default service account privileges.
Network perimeter and isolation: Pipeline execution environments must be completely isolated from the public internet, hosted in a private Virtual Private Cloud (VPC) network, and contained within a VPC Service Controls (VPC-SC) security perimeter to prevent source code and artifact exfiltration.
Secure secret access: Sensitive API keys and deployment credentials must be securely consumed dynamically during pipeline execution without storing long-lived service account keys in repositories or persisting secrets in build configuration files.

Which architecture and configuration strategy should the DevOps team implement?

Explanations

What Cloud Build Private Pools and Granular Security Controls Are

Cloud Build private pools provide fully managed, isolated worker machines that run within a customer-controlled virtual network. When combined with custom user-managed service accounts, VPC Service Controls (VPC-SC), and Secret Manager, they establish an enterprise-grade, zero-trust continuous integration and deployment pipeline.

How It Meets the Requirements

Least-privilege execution: Assigning a dedicated user-managed service account directly to Cloud Build triggers replaces the overly permissive default Cloud Build service account. Specific, granular roles (such as roles/secretmanager.secretAccessor and roles/artifactregistry.writer) ensure the pipeline only accesses authorized resources.
Network perimeter and isolation: Private worker pools execute within private worker networks peered with your VPC network. Placing these resources inside a VPC Service Controls service perimeter prevents data exfiltration by restricting API communication strictly to authorized perimeter boundaries.
Secure secret access: Cloud Build integrates natively with Secret Manager using the availableSecrets configuration stanza. Secrets are injected dynamically into individual build steps as environment variables or mounted files without exposing sensitive plaintext tokens in configuration files or code repositories.

Key Advantages and Capabilities

No public internet exposure: Worker nodes have no external IP addresses and access Google APIs via Private Google Access.
Supply chain protection: Enforces boundaries against malicious dependency fetching and unauthorized artifact uploads.
Centralized audit logging: Every secret access and build execution event is logged in Cloud Audit Logs.
Zero long-lived key risks: Eliminates the operational and security hazards associated with static downloadable service account keys.

Why This Is Optimal

This architecture adheres completely to Google Cloud security best practices by uniting network-layer isolation (VPC-SC), identity-layer boundaries (user-managed service accounts with IAM least privilege), and dynamic secret management.

View source documentation

Professional Cloud DevOps Engineer

Cloud Build Least Privilege Vpc Sc Secret Manager

Professional Cloud DevOps Engineer

Cloud Build Least Privilege Vpc Sc Secret Manager

What Cloud Build Private Pools and Granular Security Controls Are

How It Meets the Requirements

Key Advantages and Capabilities

Why This Is Optimal

Related questions