Professional Cloud DevOps Engineer
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Last updated
Your enterprise organization uses Google Cloud Deploy to manage progressive delivery across three environments: development, staging, and production.
To satisfy strict regulatory compliance and risk-mitigation policies, the organization must enforce deployment blackout windows during end-of-quarter financial auditing periods. During these scheduled windows:
StudyCerts
StudyCertsproduction target.development and staging must continue uninterrupted.Which solution should you implement to enforce these criteria?
Create an IAM Deny policy condition on roles/clouddeploy.operator that denies clouddeploy.rollouts.approve permissions using GKE cluster resource tags and temporal attributes.
Modify the Cloud Deploy DeliveryPipeline definition YAML to add a requireApproval: true parameter configured with a CEL time-window expression directly inside the production stage.
Configure a Cloud Build trigger approval gate linked to a Cloud Scheduler job that toggles Cloud Deploy pipeline pauses via Pub/Sub topics during the audit periods.
Create a Cloud Deploy DeployPolicy configuration specifying a selectors stanza matching the production target.id, configure a rolloutRestriction rule restricting APPROVE and CREATE actions across the scheduled time windows, and apply it using gcloud deploy apply.
Create an IAM Deny policy condition on roles/clouddeploy.operator that denies clouddeploy.rollouts.approve permissions using GKE cluster resource tags and temporal attributes.
Modify the Cloud Deploy DeliveryPipeline definition YAML to add a requireApproval: true parameter configured with a CEL time-window expression directly inside the production stage.
Configure a Cloud Build trigger approval gate linked to a Cloud Scheduler job that toggles Cloud Deploy pipeline pauses via Pub/Sub topics during the audit periods.
Create a Cloud Deploy DeployPolicy configuration specifying a selectors stanza matching the production target.id, configure a rolloutRestriction rule restricting APPROVE and CREATE actions across the scheduled time windows, and apply it using gcloud deploy apply.
Cloud Deploy Policies (DeployPolicy) provide declarative governance and operational guardrails for delivery pipelines and deployment targets in Google Cloud Deploy. They allow DevOps administrators to enforce compliance rules—such as change freeze windows, rollout restrictions, and approval policies—without modifying core pipeline architectures or underlying infrastructure.
selectors block to target the specific target.id (or target labels) representing the production environment, the policy applies strictly to production while leaving development and staging unaffected.rolloutRestriction rule supports granular action restrictions, specifically preventing APPROVE (approving rollout promotions) and CREATE (creating new rollouts) during designated windows.oneTimeWindows or recurring weeklyWindows to cleanly define blackout and audit periods.gcloud deploy apply --file=FILENAME.APPROVE, CREATE, ADVANCE, ROLLBACK, RETRY_JOB, and CANCEL.id or dynamically using resource labels.Using native DeployPolicy resources is the Google-recommended approach for enforcing temporal restrictions and risk gates on Cloud Deploy targets. It requires zero custom webhook development, prevents human error during change freezes, and natively intercepts API actions at the control plane level.