Examkin

Question

Difficulty: MediumContinuous Integration and Continuous Delivery (CI/CD) Pipeline Design

An enterprise architecture team is designing an automated continuous integration and continuous delivery (CI/CD) pipeline on Google Cloud to securely build, verify, and release containerized microservices to Google Kubernetes Engine (GKE). The pipeline architecture incorporates Cloud Build, Artifact Registry, Binary Authorization, and Cloud Deploy. In what chronological sequence should the pipeline stages execute from initial code submission to final production deployment?

  1. 1Cloud Build receives a source code commit trigger, compiles the application source code, and constructs the container image.
  2. 2Artifact Registry stores the container image while Container Analysis conducts automated vulnerability scanning against the image layers.
  3. 3A Binary Authorization attestor verifies the vulnerability scan results and attaches a cryptographic signature (attestation) to the specific image digest.
  4. 4Cloud Deploy creates a new release referencing the verified image digest and initiates an automated deployment rollout to the staging GKE cluster.
  5. 5Cloud Deploy conducts post-deployment verification tests in staging and automatically promotes the release target to the production GKE cluster.

Answer

The correct chronological sequence for the GCP CI/CD pipeline is: 1) Cloud Build compiles source code and builds the container image; 2) Artifact Registry stores the image and Container Analysis scans for vulnerabilities; 3) Binary Authorization verifies scan results and signs the image digest; 4) Cloud Deploy creates a release and deploys to staging GKE; 5) Cloud Deploy verifies staging health and promotes the release to production GKE.
The pipeline logically flows from artifact creation (Cloud Build) to storage/security scanning (Artifact Registry and Container Analysis), governance attestation (Binary Authorization), staging deployment orchestration (Cloud Deploy), and finally automated production promotion following verification.

Step-by-Step Solution

1
Trigger Continuous Integration Build
Cloud Build compiles source code and produces a container artifact.
Source code compilation and artifact generation are the initial steps in any CI/CD workflow.
2
Store and Scan Artifact
The container image is pushed to Artifact Registry and scanned for vulnerabilities.
Artifacts must be centralized and security-scanned before validation or deployment.
3
Cryptographic Attestation
Binary Authorization attestors verify scan compliance and sign the artifact digest.
Binary Authorization policies require an attestation before GKE admission controllers allow deployment.
4
Staging Release Rollout
Cloud Deploy creates a pipeline release and deploys the attested container to the staging target.
Progressive delivery tools require signed digests before initiating target deployments.
5
Verification and Production Promotion
Staging integration tests validate application health before advancing to production.
Automated verification ensures zero-downtime production deployment gating.

Key Concept

Secure GCP CI/CD Pipeline Lifecycle with Cloud Build, Artifact Registry, Binary Authorization, and Cloud Deploy
Rate this question

Topics

Continuous Integration and Continuous Delivery (CI/CD) Pipeline Design

More questions from this topic