2.3 Managing Pipeline Configuration and Secrets PROFESSIONAL-CLOUD-DEVOPS-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A DevOps engineer is responsible for a CI/CD pipeline that deploys to multiple environments (dev, staging, prod). The pipeline needs to use different secrets for each environment. The engineer wants to minimize the number of IAM policies and ensure that each environment can only access its own secrets. What is the best approach?

   • ACreate a separate Secret Manager secret for each environment and grant the corresponding service account access to only its secret.
   • BStore all secrets in a single secret and use IAM conditions to restrict access.
   • CUse a single secret with multiple versions, one for each environment.
   • DUse environment variables in the pipeline to select the secret.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   A DevOps engineer needs to use a secret stored in Secret Manager during a Cloud Build step to authenticate to a private repository. What is the correct way to access the secret in the build step?

   • AStore the secret in a Cloud Storage bucket and download it in the build step.
   • BUse the Cloud KMS API to decrypt the secret directly in the build step.
   • CUse the Parameter Manager API to retrieve the secret in the build step.
   • DReference the secret in the build configuration using the 'secretEnv' field, which injects it as an environment variable.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   A DevOps engineer is deciding whether to inject a secret at build time or runtime. What is a key advantage of runtime injection over build-time injection?

   • AThe secret is not embedded in the container image or artifact, reducing the risk of exposure.
   • BRuntime injection is faster than build-time injection.
   • CRuntime injection eliminates the need for IAM permissions on the secret.
   • DRuntime injection allows the secret to be used in the build process.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A DevOps engineer is responsible for a multi-region application that uses Secret Manager. The security team requires that secrets be encrypted with a customer-managed key, and that the key be available in multiple regions for disaster recovery. The engineer needs to configure Cloud KMS keys. What is the correct approach?

   • ACreate a single key ring in one region and a crypto key with a multi-region location.
   • BUse a global key ring and a global crypto key that is replicated automatically.
   • CCreate separate key rings and crypto keys in each region, and configure Secret Manager to use the appropriate key per region.
   • DUse the default encryption provided by Secret Manager, which is already multi-region.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company runs a CI/CD pipeline on GitHub Actions that needs to deploy to Google Cloud. Currently, they store a service account key as a GitHub secret. The security team wants to eliminate long-lived service account keys. What should the engineer configure?

   • AA new service account key that is rotated every 30 days.
   • BWorkload Identity Federation with GitHub as the identity provider.
   • CStore the service account key in Secret Manager and reference it in the pipeline.
   • DUse Application Default Credentials on the GitHub runner.
   Reveal Solution Discussion Select an answer first