2.3 Managing Pipeline Configuration and Secrets PROFESSIONAL-CLOUD-DEVOPS-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   A DevOps engineer wants to use a certificate managed by Certificate Manager with an HTTPS load balancer. What is the correct way to associate the certificate with the load balancer?

   • AStore the certificate in Secret Manager and reference it in the load balancer.
   • BUpload the certificate directly to the load balancer's backend service.
   • CUse Cloud KMS to encrypt the certificate and attach it to the load balancer.
   • DReference the certificate map in the load balancer's SSL certificate configuration.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company has a Cloud Functions application that needs to read a configuration parameter (e.g., feature flag) that changes frequently. The team wants to update the parameter without redeploying the function. What should they use?

   • ASecret Manager to store the parameter.
   • BEnvironment variables set at deployment time.
   • CA configuration file in the function's source code.
   • DParameter Manager to store the parameter and have the function read it at runtime.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A DevOps engineer is setting up a Cloud Build pipeline for a Java application. The build needs to access a private Maven repository using credentials that are stored in Secret Manager. The engineer wants to avoid exposing the credentials in build logs and ensure they are only available during the build step that needs them. What is the recommended approach?

   • AUse the 'secretEnv' field in the build step to reference the secret version, and access it as an environment variable in the build step.
   • BUse the 'substitutions' field to pass the credentials as a build substitution variable.
   • CStore the credentials in a Kubernetes Secret and mount them into the build step as a volume.
   • DStore the credentials in a Cloud Storage bucket and use a 'gsutil cp' command in the build step to download them.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   A DevOps engineer needs to organize encryption keys for different environments (dev, staging, prod) in Cloud KMS. What is the correct hierarchical structure for organizing these keys?

   • ACrypto keys are created directly in a location without any grouping mechanism.
   • BCrypto keys are grouped into key rings, and key rings are created within a location.
   • CKey rings are grouped into crypto keys, and crypto keys are created within a location.
   • DKey rings are created globally, and crypto keys are assigned to locations individually.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   A DevOps engineer is configuring Workload Identity Federation for a GitHub Actions workflow. What is the primary benefit of using this approach over downloading a service account key?

   • AIt allows the use of any external identity provider without configuration.
   • BIt eliminates the need to store and manage long-lived service account keys.
   • CIt grants broader permissions than a service account key.
   • DIt provides a faster authentication process than using service account keys.
   Reveal Solution Discussion Select an answer first