GCP Professional Cloud Architect Practice Question

Your organization is migrating on-prem CI/CD pipelines to Google Cloud for a microservices application running on GKE. The new process must:

Use a managed Git repo for code pushes.
Have a managed service that builds container images, runs unit tests, and stores artifacts in a private registry.
Automatically scan images for vulnerabilities and licenses.
Require human approval before production promotion.
Minimize infrastructure maintenance. Which design meets these needs?

Run Jenkins on a Compute Engine instance to build Docker images, store them in Cloud Storage, scan them with a third-party plugin, and deploy using Deployment Manager templates.
Use Cloud Source Repositories with a Cloud Build trigger that builds and tests the code, stores the image in Artifact Registry with vulnerability scanning enabled, and delivers through Cloud Deploy with a manual approval gate before the production target.
Trigger a Cloud Function on each commit that builds the image locally, pushes it to Artifact Registry, and schedules a rollout to production using Cloud Scheduler without requiring manual approval.
Use Cloud Build to build and push images to Container Registry, then run a custom GKE job that invokes the open-source Clair scanner; after scanning, deploy to GKE automatically with kubectl.

Report Issue

Answer Description

Cloud Build triggers connected to Cloud Source Repositories provide a fully managed service that compiles code, runs tests, and publishes images to Artifact Registry. When vulnerability scanning is enabled, Artifact Registry automatically analyzes uploaded images; Cloud Build can halt the pipeline if critical issues are detected. Cloud Deploy consumes images stored in Artifact Registry and offers manual approval gates before advancing a release to production, satisfying the explicit human-approval requirement. All chosen components are fully managed, keeping operational overhead low.

Incorrect designs depend on self-managed tooling, omit automated scanning, or lack an approval step, so they fail to satisfy at least one stated requirement.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.