Prepare and test your skills
Prepare and test your skills
Free sample question, answered and explained below. The Professional Cloud Security Engineer practice bank has 1,343 more like it. Try 10 free: instant score, no account.
A security engineer is designing an automated image maintenance pipeline in Google Cloud to ensure base container images are continuously patched against newly disclosed vulnerabilities and dependencies remain up to date.
The solution must meet the following requirements:
Which architecture and configuration should the engineer implement?
gcloud builds submit using a service account assigned the basic Owner (roles/owner) role, and configure Artifact Registry with automated cross-region repository replication.This option deploys an intermediary Cloud Functions service invoked via Pub/Sub from Cloud Scheduler to execute ad-hoc image builds using broad primitive IAM permissions.
roles/owner) role to the Cloud Function's service account introduces severe over-privileging and broad administrative risk across all project resources.The build process required complex dynamic pre-processing logic, payload transformations, or multi-cloud event routing before initiating a Cloud Build job.
This design attempts to run a custom Docker-in-Docker container build engine on Cloud Run Jobs while attempting to rely on external synchronization policies in Artifact Registry.
The pipeline required running proprietary custom compilation toolchains that cannot execute within standard Cloud Build build steps or private worker pools.
roles/cloudbuild.builds.editor) role. Grant the Cloud Build service account the Artifact Registry Writer (roles/artifactregistry.writer) role and enable the Container Scanning API.This architecture establishes an automated, serverless image rebuild and vulnerability scanning pipeline using Cloud Scheduler, Cloud Build, and Artifact Registry alongside Artifact Analysis (Container Scanning).
0 1 * * *) to invoke the Cloud Build API REST endpoint (.../triggers/$TRIGGER_ID:run), initiating an automated rebuild from source configurations to pull down updated base packages.roles/cloudbuild.builds.editor), and the Cloud Build service account is granted the scoped Artifact Registry Writer (roles/artifactregistry.writer) role to push images without administrative over-privileging.This approach aligns with Google Cloud security best practices by utilizing native REST integrations between Cloud Scheduler and Cloud Build, eliminating the operational overhead, credential management risks, and maintenance complexity of intermediary functions or virtual machines.
gcloud builds submit using a downloaded service account key assigned the Service Account User (roles/iam.serviceAccountUser) role, storing built images in Cloud Storage buckets before manually copying them to Artifact Registry.This configuration relies on self-managed infrastructure (Compute Engine VM) and scheduled cron daemons to submit builds using long-lived exported service account keys.
roles/iam.serviceAccountUser) role allows an identity to attach a service account to a resource, but it does not grant permissions to create or submit builds in Cloud Build.images stanza or docker builder.The organization had a strict regulatory requirement mandating entirely air-gapped on-premises or VM-isolated build orchestration agents without access to managed Google Cloud scheduling APIs.
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
Keep the momentum going with these hand-picked practice scenarios
Last updated Validated