GCP Professional Data Engineer Practice Question

Your team stores Apache Beam pipelines in a GitHub repository. You need to trigger a Cloud Build job only when code is pushed to the main branch-ignoring all other branches and tags-and run the build only if at least one file in the dataflow/ directory (or its subfolders) has changed. The build must execute under a dedicated Cloud Build service account that has the minimum IAM roles required to launch Dataflow jobs and upload artifacts to Cloud Storage (roles/dataflow.admin and roles/storage.admin). Which trigger configuration meets all of these requirements?

Set up a GitHub App trigger for "push to tag" events matching v.*, without includedFiles filtering, and let the default Cloud Build service account run the build.
Create a Cloud Source Repositories trigger that fires on any push (branch regex ".*"), omit file-path filters, and allow the default Compute Engine default service account to execute the build.
Configure a GitHub App trigger that starts on pull_request events, rely on Cloud Build's default service account with the broader roles/editor role, and skip path filtering.
Define a GitHub App Cloud Build trigger that listens for the "push to branch" event, uses the branch regex ^main$, sets includedFiles to ["dataflow/**"], and runs under a custom Cloud Build service account granted only roles/dataflow.admin and roles/storage.admin.

Report Issue

Answer Description

A GitHub App-based Cloud Build trigger configured for the "Push to a branch" event with a branch-name regular-expression filter of ^main$ restricts execution to commits that land on the main branch. Adding an includedFiles filter set to ["dataflow/**"] ensures the build runs only when files under the dataflow/ path change. Finally, specifying a custom Cloud Build service account that holds only roles/dataflow.admin (to create Dataflow jobs) and roles/storage.admin (to write to Cloud Storage) limits its permissions to what the build actually needs, avoiding broader roles such as Editor or Owner. The alternative configurations either monitor the wrong event (pull_request or tag), lack file-path filtering, use a different repository type, or run with overly privileged default service accounts, so they do not fulfill all stated constraints.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.