2.3 Managing Pipeline Configuration and Secrets PROFESSIONAL-CLOUD-DEVOPS-ENGINEER Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A DevOps engineer is setting up a CI/CD pipeline that runs on a self-hosted runner in a different cloud provider. The pipeline needs to access a secret in Secret Manager. The security team requires that the secret be encrypted with a customer-managed key and that the pipeline authenticate without a service account key. What is the best approach?

   • AUse Workload Identity Federation to authenticate, and configure the secret to use a CMEK from Cloud KMS.
   • BUse the default encryption of Secret Manager and authenticate with a service account key.
   • CCreate a service account key and store it in the runner's environment.
   • DUse a service account key stored in Secret Manager.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   A DevOps engineer is deciding whether to inject a secret at build time or runtime. What is a key consideration when choosing build-time injection?

   • AThe secret is a configuration parameter that changes frequently.
   • BThe secret is only needed during the build process, such as for pulling dependencies from a private repository.
   • CThe secret is needed by the application at runtime, such as a database password.
   • DThe secret is used to sign the build artifact.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   A DevOps engineer needs to store a non-sensitive configuration parameter (e.g., a feature flag) and retrieve it in a Cloud Run service. Which Google Cloud service is designed for this purpose?

   • AParameter Manager
   • BCloud KMS
   • CCloud Storage
   • DSecret Manager
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A DevOps engineer is setting up an HTTPS load balancer for a web application. The team wants to use a certificate that is managed and renewed automatically by Google. What should the engineer use?

   • AUse Cloud KMS to generate a certificate and attach it to the load balancer.
   • BCertificate Manager to create a Google-managed certificate and attach it to the load balancer.
   • CUpload a self-signed certificate and configure auto-renewal manually.
   • DUse a certificate from a third-party CA and store it in Secret Manager.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A DevOps engineer is building a pipeline that compiles a mobile app. The build needs to sign the app with a certificate that is stored in Secret Manager. The certificate is sensitive and should not be exposed to all developers. The engineer wants to ensure that only the build process can access the certificate. What is the best approach?

   • AStore the certificate in a Cloud Storage bucket and download it in the build step.
   • BGrant the Cloud Build service account access to the secret, and use 'secretEnv' to inject it into the build step.
   • CEmbed the certificate in the source code repository.
   • DUse a substitution variable to pass the certificate to the build step.
   Reveal Solution Discussion Select an answer first