GCP Professional Cloud Architect Practice Question

Developers at a financial-services firm push code for several microservices to GitHub Enterprise. Company policy requires that every container image be vulnerability-scanned before deployment. Operations wants a declarative release pipeline that automatically promotes releases from a staging GKE cluster to production, includes manual approval gates, supports automated rollback on failure, and demands minimal platform maintenance. Which Google Cloud-based design best satisfies all requirements?

Orchestrate the workflow in Cloud Composer: one DAG task runs docker build, a second task uploads to Artifact Registry, and subsequent tasks invoke Cloud Functions that execute kubectl commands after support engineers manually update the DAG to promote between environments.
Use Cloud Build with a GitHub trigger to build and push images, then add a build step that runs kubectl apply to deploy directly to the staging and production GKE clusters, relying on GKE rollout history for manual rollback if needed.
Run a self-hosted Jenkins pipeline on a dedicated GKE node pool to build images, store them in Container Registry, scan them with an open-source Clair server, and deploy with Helm charts to both clusters.
Trigger Cloud Build from GitHub Enterprise to build and test each commit, push the resulting image to Artifact Registry for automatic vulnerability scanning, then use Cloud Deploy with staged targets (staging → production) that include approval gates and built-in rollback to GKE.

Report Issue

Answer Description

Cloud Build can be triggered directly from GitHub Enterprise to compile, test, and build container images. Pushing those images to Artifact Registry automatically invokes Container Analysis vulnerability scanning, meeting the security mandate without extra tooling. Cloud Deploy consumes the image and a Skaffold-based manifest to create a release that is promoted through a staging and production delivery pipeline. Cloud Deploy natively supports approval gates between targets and can initiate rollback if a deployment fails a health check, all delivered as a fully managed service that minimizes operational overhead. The other options either lack native vulnerability scanning, do not provide managed approval/rollback capabilities, or require substantial self-managed infrastructure.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.