Professional Cloud DevOps Engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Last updated
An enterprise organization operates a multi-tenant Google Cloud environment where multiple development teams share a central CI/CD project. Each team builds containerized microservices and deploys them to dedicated Artifact Registry repositories in their respective workload projects.
To meet stringent security compliance standards, the DevOps team must ensure that:
How should the DevOps engineer configure the Cloud Build triggers and IAM permissions?
Create dedicated, user-managed custom service accounts for each team with granular roles scoped to their resources, assign each custom service account to its corresponding Cloud Build trigger, and grant developers the Service Account User role on their team's service account.
Grant the Cloud Build Service Agent role directly to custom user-managed service accounts and attach them to each team's trigger configuration.
Execute all triggers using the default Cloud Build service account, and apply IAM condition tags at the central project level to restrict resource access per repository.
Generate long-lived JSON service account keys for each tenant, store them in Secret Manager, and download and activate them using gcloud auth activate-service-account in the first build step.
Create dedicated, user-managed custom service accounts for each team with granular roles scoped to their resources, assign each custom service account to its corresponding Cloud Build trigger, and grant developers the Service Account User role on their team's service account.
User-specified custom service accounts allow Cloud Build triggers to execute builds under a defined identity rather than using the default Cloud Build service account. This allows fine-grained access management and complete IAM isolation across different workloads and development teams.
StudyCerts
StudyCertsroles/artifactregistry.writer restricted directly to the team's specific Artifact Registry repository and roles/logging.logWriter for build logs.roles/iam.serviceAccountUser to the development team on their dedicated service account allows them to associate that service account with their build triggers without granting excessive project-level permissions or managing long-lived static credentials.Assigning custom service accounts directly to Cloud Build triggers is Google Cloud's recommended architectural pattern for multi-tenant CI/CD pipelines. It provides strong boundary separation, enforces least privilege out of the box, and relies entirely on native IAM governance without operational overhead.
Grant the Cloud Build Service Agent role directly to custom user-managed service accounts and attach them to each team's trigger configuration.
Execute all triggers using the default Cloud Build service account, and apply IAM condition tags at the central project level to restrict resource access per repository.
Generate long-lived JSON service account keys for each tenant, store them in Secret Manager, and download and activate them using gcloud auth activate-service-account in the first build step.