Prepare and test your skills
Prepare and test your skills
Free sample question, answered and explained below. The Professional Cloud DevOps Engineer practice bank has 1,455 more like it. Try 10 free: instant score, no account.
Your enterprise is designing a secure CI/CD pipeline and runtime deployment in Google Cloud to handle sensitive application configurations and secrets. Your corporate security team imposes the following compliance and architectural requirements:
projects/corp-sec-kms).Which set of configuration steps should you implement to satisfy these requirements?
This option creates decentralized keys across individual application projects and assigns the broad roles/owner primitive role to workload service accounts.
projects/corp-sec-kms and prevents the organization from enforcing key project constraints.roles/owner role grants nearly unrestricted administrative control over all Google Cloud resources in the project, completely violating the principle of least privilege.roles/owner, roles/editor, roles/viewer) should be avoided in production CI/CD workflows.You were creating a temporary sandbox environment with no corporate compliance constraints where developers manage all localized resources independently.
This option sets constraints/gcp.restrictNonCmekServices in the KMS project and assigns the roles/cloudkms.admin role to automated pipeline and runtime service accounts.
roles/cloudkms.admin) role allows administrative actions such as creating, updating, disabling, and scheduling keys for destruction, but it does not grant permissions to encrypt or decrypt data (cloudkms.cryptoKeyVersions.useToEncrypt / cloudkms.cryptoKeyVersions.useToDecrypt). Granting administrative roles to automated execution identities severely violates least privilege.constraints/gcp.restrictCmekCryptoKeyProjects is specifically designed to enforce that CMEK keys come from an allowed project hierarchy. Setting restrictNonCmekServices on the KMS project does not enforce which projects can supply keys for workload encryption.roles/cloudkms.admin is intended solely for security officers and key managers.roles/cloudkms.cryptoKeyEncrypterDecrypter), not control-plane key administration.You needed to grant human security administrators permission to configure key rings and metadata policies without allowing them direct access to decrypt application payload data.
This option uses asymmetric signing keys in Cloud KMS and binds the roles/cloudkms.cryptoKeyDecrypter role to the execution identities.
--purpose=encryption). Asymmetric signing keys are used for digital signatures and verification, not for envelope encryption of customer data.roles/cloudkms.cryptoKeyDecrypter provides decryption rights, preventing the pipeline or service agent from encrypting new secrets or configuration versions upon resource creation.roles/cloudkms.cryptoKeyEncrypterDecrypter role is standard for CMEK service agents.The goal was specifically building an automated binary signing pipeline where build systems sign provenance metadata using asymmetric private keys.
This solution implements centralized Customer-Managed Encryption Key (CMEK) governance in Google Cloud by enforcing organization-level key project boundaries while provisioning symmetric encryption keys in Cloud Key Management Service (Cloud KMS) with fine-grained Cloud IAM access controls.
constraints/gcp.restrictCmekCryptoKeyProjects constraint with the rule under:projects/corp-sec-kms prevents workloads from using keys from unauthorized projects, ensuring all encryption keys reside solely within the central security project.roles/cloudkms.cryptoKeyEncrypterDecrypter (Cloud KMS CryptoKey Encrypter/Decrypter) role directly to the relevant service agents and runtime service accounts provides exact encrypt and decrypt capabilities without granting key administration or destruction privileges.corp-sec-kms.This architecture perfectly satisfies organizational compliance requirements by preventing shadow key creation across distributed workload projects, using standard symmetric CMEK patterns, and strictly limiting IAM permissions to cryptographic operations.
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
Keep the momentum going with these hand-picked practice scenarios
Last updated