Home Microsoft Exams Google Cloud Exams

Loading page

Curious about new developments and updates? Follow our social media.

Get a free certification question every week.

Microsoft Exams

AZ-104 Administrator
AZ-204 Developer
AZ-900 Fundamentals
All Microsoft Exams

Google Cloud Exams

Associate Data Practitioner
All Google Cloud Exams

Terms Privacy Cookies About Pricing

© 2026 StudyCerts. All rights reserved.

StudyCerts is an independent service and is not affiliated with, endorsed by, or sponsored by any certification body or cloud provider.

Loading page

Home
Google Cloud Exams
Professional Cloud DevOps Engineer
Managing ephemeral environments
Your enterprise DevOps team needs to implement an automated …

Professional Cloud DevOps Engineer

Professional Cloud DevOps Engineer

Advanced

Prepare and test your skills

Description
Sample Question
Free Trial
Practice Test

Advanced

Prepare and test your skills

Description
Sample Question
Free Trial
Practice Test

Iac Ephemeral Environment Pipeline Architecture

Section: Managing ephemeral environments

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

...

...

...

...

...

Explanations

...

View source documentation

Related questions

Keep the momentum going with these hand-picked practice scenarios

AdvancedProfessional Cloud DevOps Engineer

Your enterprise uses automated CI/CD pipelines that dynamically provision ephemeral Google Cloud projects to run integration tests and validate containerized workloads. These temporary environments create Compute Engine instances, Cloud Storage buckets, and analytical clusters before being destroyed. Your security team mandates the following governance requirements for all ephemeral environments: Prevent the generation of persistent service account key files across all short-lived resources. Mitigate data exfiltration risks by enforcing context-based perimeter security around Google Cloud APIs and storage resources. Allow developers to request audited, just-in-time elevated permissions for troubleshooting failed test runs without distributing persistent administrative privileges. Which combination of Google Cloud security controls and configuration management policies should you implement?

Managing ephemeral environments

AdvancedProfessional Cloud DevOps Engineer

Your enterprise uses automated CI/CD pipelines to dynamically provision ephemeral test environments for pull requests. Multiple engineering teams deploy dozens of short-lived Google Cloud projects daily. You must implement a governance, lifecycle, and cost control strategy that satisfies the following requirements: Allow automated CI/CD service accounts to link new projects to the central billing account without granting broad billing administrative privileges. Accurately attribute cloud expenditures to specific teams and environment lifecycles for cost tracking. Enforce automated teardown of orphaned or expired ephemeral projects based on a defined time-to-live (TTL). What should you do?

Managing ephemeral environments

AdvancedProfessional Cloud DevOps Engineer

Your enterprise is deploying Google Cloud Workstations for a software development team requiring custom development tooling and internal security packages. You must establish a secure lifecycle and deployment workflow for these workstations that satisfies the following requirements: Workstation container images must automatically rebuild on a daily schedule to incorporate upstream base image security updates. Container images must reside in a private repository and undergo automated vulnerability scanning upon upload. Cloud Workstations must securely pull the private container images following least-privilege access control. Which combination of steps should you implement to satisfy these requirements?

Configuring and managing cloud development environments (e.g., Cloud Workstations, Cloud Shell)

AdvancedProfessional Cloud DevOps Engineer

Your team manages an automated batch analytics pipeline deployed on a Google Cloud Dataproc cluster with autoscaling enabled. During analysis of recent billing alerts, you notice that the cluster consistently scales up during Apache Spark job execution but fails to scale down worker nodes after processing completes, remaining at peak worker capacity and incurring excess compute costs. Observability metrics in Cloud Monitoring show that YARN Pending resource drops to zero and Available resource is high, but Spark executor containers are not being decommissioned because interim data was persisted into memory using DataFrame cache operations. Which corrective action should you implement to resolve this autoscaling failure?

Infrastructure issues

AdvancedProfessional Cloud DevOps Engineer

Your enterprise organization uses GitHub Actions CI/CD workflows to build and deploy multi-tier containerized applications to Google Cloud. Your security team mandates the elimination of all long-lived service account keys to mitigate credential leakage risks. Additionally, you must ensure that only CI/CD pipelines originating from specific repositories within your GitHub organization are permitted to impersonate the target deployment service accounts. How should you configure Workload Identity Federation to meet these security and operational requirements?

Configuration and secret management (e.g., Secret Manager, Certificate Manager, Parameter Manager, Workload Identity Federation)

AdvancedProfessional Cloud Security Engineer

An enterprise is architecting a high-throughput, low-latency transaction processing platform on Google Cloud using managed services such as Firestore in Datastore mode and Dataproc Metastore across the us multi-region. The security engineering team must establish a key management architecture that satisfies several operational and architectural requirements: Access and lifecycle control: The organization must maintain cryptographic key control, audit logging, and the ability to revoke keys independently of Google default encryption. Performance and latency: High-volume transactional read and write operations must not incur per-transaction cryptographic RPC overhead or latency degradation. High availability: Key resolution must support regional and multi-regional redundancy without depending on external infrastructure or off-cloud network links. Service integration: The keys must adhere to Google Cloud customer-managed encryption key (CMEK) location-matching constraints across regional and multi-regional deployments. Which cryptographic key management architecture should the organization implement to fulfill these requirements?

Determining when to use software and hardware keys

Want more questions like this?

Get a free certification question every week.

Last updated August 28, 2026

Are you ready for the Professional Cloud DevOps Engineer?

50 questions in the full practice test

More Managing ephemeral environments practice questions

Get a free certification question with a full explanation every week.

Professional Cloud DevOps Engineer

Provider: Google Cloud
Passing score: 70%
Questions: 50
Duration: 90 minutes

Other sections in this exam

Bootstrapping and maintaining a Google Cloud organization
Building and implementing CI/CD pipelines, including continuous testing, for application, infrastructure, and machine learning workloads
Applying site reliability engineering practices
Implementing observability practices and troubleshooting issues
Optimizing performance and cost

Ask Scout

Still curious? Scout, our AI tutor, can explain this concept further and answer your follow-up questions.

Your enterprise DevOps team needs to implement an automated ephemeral environment strategy for feature branch testing on Google Cloud. Every time a developer opens a pull request (PR), an isolated environment containing dedicated Google Kubernetes Engine (GKE) workloads and supporting Google Cloud resources (such as Cloud Storage buckets and service accounts) must be created on-demand. The solution must ensure secure state isolation, prevent resource naming collisions across concurrent PRs, execute integration test suites, and automatically tear down all provisioned resources when the PR is closed or merged.

How should you architect this pipeline to meet these requirements?

Configure Cloud Build triggers listening to PR events that invoke Terraform using dynamic state prefixes in Cloud Storage for environment provisioning, and configure an automated PR closure trigger to execute a destruction pipeline.

Deploy a permanent, multi-tenant GKE cluster with manual namespace assignments and execute non-declarative shell scripts in Cloud Build to provision GCP backend resources directly via gcloud commands.

Create a scheduled Cloud Scheduler job that runs an hourly Cloud Build pipeline executing Terraform across all active Git branches using a single shared default workspace.

Use Cloud Composer to trigger Google Cloud Deployment Manager to provision a brand new Google Cloud Organization folder and standalone billing account per pull request.

Configure Cloud Build triggers listening to PR events that invoke Terraform using dynamic state prefixes in Cloud Storage for environment provisioning, and configure an automated PR closure trigger to execute a destruction pipeline.

What the Solution Is

This architecture leverages Cloud Build triggers integrated with source repository events (such as pull request opening, synchronizing, and closing) alongside modular Terraform configurations that utilize dynamic state key paths in a centralized Cloud Storage (GCS) backend.

How It Meets the Requirements

Automated Lifecycle Integration: Cloud Build triggers automatically execute terraform apply when a PR is opened or updated, passing unique branch/PR identifiers (e.g., pr-${_PR_NUMBER}) to parameterize resource names and deploy workloads to isolated GKE namespaces.
State Isolation and Collision Prevention: Storing Terraform state with dynamic object prefixes in Google Cloud Storage (terraform init -backend-config="prefix=env/pr-${_PR_NUMBER}") ensures that concurrent branch builds maintain completely independent state files without locking or overwriting each other.
Automated Cleanup: A dedicated Cloud Build trigger configured for repository PR closed/merged events executes terraform destroy pointing to the exact same dynamic state path, guaranteeing complete resource destruction and preventing cloud spend leakage.

Key Advantages and Capabilities

Deterministic Infrastructure as Code: Reuses tested, modular Terraform code across ephemeral and static environments.
Zero Infrastructure Drift: Ephemeral resources are short-lived and disposable, eliminating configuration drift.
Granular Security Controls: Cloud Build service accounts assume fine-grained IAM roles using short-lived credentials to provision GKE and storage resources securely.
Cost Efficiency: Automating destruction on PR closure prevents orphaned cloud resources from incurring ongoing charges.

Why This Is Optimal

Dynamic Terraform state management combined with native Git webhook triggers in Cloud Build provides a fully declarative, event-driven, and cost-effective lifecycle for isolated preview environments without manual operational overhead.

Deploy a permanent, multi-tenant GKE cluster with manual namespace assignments and execute non-declarative shell scripts in Cloud Build to provision GCP backend resources directly via gcloud commands.

Create a scheduled Cloud Scheduler job that runs an hourly Cloud Build pipeline executing Terraform across all active Git branches using a single shared default workspace.

Use Cloud Composer to trigger Google Cloud Deployment Manager to provision a brand new Google Cloud Organization folder and standalone billing account per pull request.