Prepare and test your skills
Prepare and test your skills
Free sample question, answered and explained below. The Professional Cloud DevOps Engineer practice bank has 1,455 more like it. Try 10 free: instant score, no account.
Your organization is designing a multi-project CI/CD security architecture using Artifact Registry and Artifact Analysis. You maintain a centralized security-metadata-prod project (acting as the metadata provider) to store compliance and attestation notes, while multiple application team projects host Artifact Registry repositories (acting as metadata customers) where container images are built and stored.
You need to configure Identity and Access Management (IAM) roles and security controls to meet the following requirements:
security-metadata-prod.security-metadata-prod.Which IAM role configuration and security mechanism should you implement?
security-metadata-prod and the Container Analysis Notes Attacher role in application projects. Grant compliance auditors the Container Analysis Notes Editor role in all application projects. Enforce VPC Service Controls egress rules to block vulnerability modifications.This option proposes using Artifact Registry Writer in the provider project, placing Container Analysis Notes Attacher in customer application projects, and using VPC Service Controls perimeter egress rules to restrict vulnerability record modifications.
roles/containeranalysis.notes.attacher role must be granted in the provider project (where notes are hosted), not the customer project. Granting it in the customer project does not provide permission to reference notes in the central project.roles/artifactregistry.writer) grants container push/pull permissions to an Artifact Registry repository, which is not what controls Artifact Analysis note attachment.The primary goal was network isolation of Artifact Registry storage buckets without requiring metadata provider-customer separation.
security-metadata-prod and application projects. Grant compliance auditors the Container Analysis Occurrences Editor role in security-metadata-prod. Disable the Artifact Analysis API in application projects to prevent manual edits.This option suggests assigning the Container Analysis Service Agent role (roles/containeranalysis.ServiceAgent) directly to CI/CD service accounts, granting auditors occurrence editor rights in the central project, and disabling the API in customer projects.
roles/*.serviceAgent) to user accounts or standard CI/CD service accounts. Service agent roles are reserved strictly for internal Google-managed system identities.You were configuring the internal Google Cloud control plane service identity during initial service enablement.
security-metadata-prod and the Container Analysis Occurrences Viewer role in application projects. Grant compliance auditors the Container Analysis Occurrences Viewer role in security-metadata-prod. Configure an IAM deny policy on containeranalysis.occurrences.delete in all application projects.This option suggests granting CI/CD pipelines the Container Analysis Notes Editor role centrally, granting auditors the Container Analysis Occurrences Viewer role in the provider project, and using IAM deny policies to prevent deletion of vulnerability metadata.
roles/containeranalysis.notesEditor gives them permissions to modify, update, and create notes in the central metadata project rather than restricting them to attaching occurrences to existing notes.roles/containeranalysis.occurrencesForNotes.viewer.The CI/CD pipelines were responsible for authoring and defining organizational compliance notes from scratch and auditors had individual read access to every distributed application project.
security-metadata-prod. Grant compliance auditors the Container Analysis Occurrences for Notes Viewer role in security-metadata-prod. Rely on the built-in Artifact Analysis security model that blocks customer write permissions to third-party vulnerability provider occurrences.The Artifact Analysis metadata model distinguishes between metadata providers (which create and manage centralized notes describing policies, vulnerabilities, or build attestations) and metadata customers (which attach occurrences targeting specific container images to those notes). In an enterprise CI/CD architecture, isolating notes into a dedicated provider project ensures centralized governance across distributed application repositories.
roles/containeranalysis.occurrences.editor (Container Analysis Occurrences Editor) granted in the customer project to instantiate new occurrences targeting container images, and roles/containeranalysis.notes.attacher (Container Analysis Notes Attacher) granted in the provider project (security-metadata-prod) to bind those occurrences to the centralized note.roles/containeranalysis.occurrencesForNotes.viewer (Container Analysis Occurrences for Notes Viewer) in the provider project allows them to retrieve and list all attached occurrences across all external customer projects linked to a given note.This solution uses native Google Cloud IAM role mappings and built-in Artifact Analysis security protections without requiring custom IAM policies or complex manual perimeter synchronizations.
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
Keep the momentum going with these hand-picked practice scenarios
Last updated Validated