2.3 Managing Pipeline Configuration and Secrets PROFESSIONAL-CLOUD-DEVOPS-ENGINEER Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   A DevOps engineer wants to reference a parameter stored in Parameter Manager from a Cloud Run service. What is the correct way to do this?

   • AStore the parameter in a Cloud Storage bucket and read it from there.
   • BMount the parameter as a volume in the Cloud Run container.
   • CUse the parameter reference syntax in the Cloud Run service configuration, e.g., projects/PROJECT_ID/parameters/MY_PARAM.
   • DUse the Secret Manager API to retrieve the parameter value at runtime.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A DevOps engineer is designing a CI/CD pipeline for a machine learning workload. The pipeline needs to access a training dataset that is encrypted with a customer-managed key. The training job runs on Vertex AI. The engineer wants to ensure that the key is not exposed to the pipeline and that the training job can access the dataset. What is the best approach?

   • AGrant the Vertex AI service account the Cloud KMS CryptoKey Decrypter role on the key, and configure the dataset to use that key.
   • BUse a service account key to allow the pipeline to decrypt the dataset and pass it to Vertex AI.
   • CDownload the dataset and encrypt it with a new key in the pipeline, then pass the key to Vertex AI.
   • DStore the key in Secret Manager and have the training job read it at runtime.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   A DevOps engineer wants to use a secret from Secret Manager in a Cloud Build step. What IAM permission must the Cloud Build service account have to access the secret?

   • Aroles/secretmanager.admin on the project
   • Broles/cloudbuild.builds.editor on the project
   • Croles/cloudkms.cryptoKeyDecrypter on the key
   • Droles/secretmanager.secretAccessor on the secret
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   A DevOps engineer needs to manage SSL/TLS certificates for an HTTPS load balancer. Which Google Cloud service is specifically designed for this purpose?

   • AIdentity-Aware Proxy (IAP)
   • BCloud KMS
   • CCertificate Manager
   • DSecret Manager
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   A DevOps engineer wants to allow an external CI/CD system (e.g., GitHub Actions) to authenticate to Google Cloud without creating and distributing a service account key. Which feature should be used?

   • AWorkload Identity Federation
   • BCloud IAM Conditions
   • CService Account Key rotation
   • DVPC Service Controls
   Reveal Solution Discussion Select an answer first