2.3 Managing Pipeline Configuration and Secrets PROFESSIONAL-CLOUD-DEVOPS-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A Cloud Build pipeline needs to access a secret stored in Secret Manager during a build step. The engineer wants to ensure that the secret is not visible in the build logs. What should they do?

   • AUse the 'secretEnv' field to inject the secret as an environment variable in the build step.
   • BUse the 'substitutions' field to pass the secret as a variable.
   • CUse a shell command to read the secret and echo it to a file.
   • DStore the secret in a Cloud Storage bucket and download it in the build step.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   A DevOps engineer needs to grant a CI/CD service account permission to encrypt data with a specific Cloud KMS key. Which IAM role should be assigned at the key level?

   • Aroles/cloudkms.cryptoKeyEncrypter
   • Broles/cloudkms.viewer
   • Croles/cloudkms.admin
   • Droles/cloudkms.cryptoKeyDecrypter
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A DevOps engineer is designing a pipeline for a microservices application. Some secrets are needed only during the build (e.g., API keys for pulling dependencies), while others are needed at runtime (e.g., database credentials). What is the best practice for handling these secrets?

   • AEmbed all secrets in the container image and use them at runtime.
   • BInject build-time secrets via Secret Manager in the build step, and runtime secrets via Secret Manager mounted as volumes in the application.
   • CUse environment variables for both build-time and runtime secrets.
   • DUse Cloud KMS to encrypt secrets and store them in the source code.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company is migrating to Google Cloud and needs to manage SSL/TLS certificates for multiple domains. They want to use a single certificate for multiple domains and have it automatically renewed. The certificate must be used by an HTTPS load balancer. What should the engineer do?

   • ACreate a Google-managed certificate in Certificate Manager with multiple SANs and attach it to the load balancer.
   • BUse a self-signed certificate with multiple SANs and configure auto-renewal.
   • CCreate separate certificates for each domain and attach them all to the load balancer.
   • DStore a certificate from a third-party CA in Secret Manager and attach it to the load balancer.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security team requires that all secrets stored in Secret Manager be encrypted with a customer-managed key. The DevOps engineer needs to configure this. What should they do?

   • AEncrypt the secret manually before storing it in Secret Manager.
   • BStore the secret in Cloud KMS instead of Secret Manager.
   • CCreate a Cloud KMS key and set it as the encryption key for the Secret Manager secret.
   • DUse the default encryption provided by Secret Manager, which is already customer-managed.
   Reveal Solution Discussion Select an answer first