Examkin

Question

Difficulty: MediumContinuous Integration and Continuous Delivery (CI/CD) Pipeline Design

A media streaming organization is designing an automated CI/CD pipeline on Google Cloud to deploy microservice applications to Google Kubernetes Engine (GKE). The engineering team requires that code pushed to release branches automatically triggers container builds, executes security scanning, enforces image integrity verification prior to deployment, and manages progressive canary rollouts across staging and production with automated rollback capabilities upon metric anomalies. Which pipeline design best fulfills these requirements following Google Cloud best practices?

  1. Configure Cloud Build triggers for branch commits to build container images, store them in Artifact Registry, generate Binary Authorization attestations after scanning, and use Cloud Deploy pipelines to manage multi-target progressive rollouts with Cloud Monitoring metric alerts for automated rollbacks.Answer
  2. B
    Assign the Owner role to the default Cloud Build service account and execute custom inline bash scripts within a single build step to compile code, build container images, and directly execute kubectl apply commands against production clusters without pipeline release management tools.
  3. C
    Configure Cloud Build to execute concurrent build tasks that write application build artifacts and Terraform state files to an unversioned local Cloud Storage bucket, applying infrastructure updates directly across staging and production environments simultaneously.
  4. D
    Grant developer user accounts the Service Account Admin role so that Cloud Build triggers can generate static service account keys per build run, embedding the key files inside container images to authenticate runtime deployments.

Answer

The optimal design uses Cloud Build triggers integrated with Artifact Registry and Binary Authorization for secure container building and signing, paired with Cloud Deploy to orchestrate progressive canary rollouts and metric-based automated rollbacks.
The solution leveraging Cloud Build, Artifact Registry, Binary Authorization attestations, and Cloud Deploy provides a complete, cloud-native CI/CD architecture. Cloud Build automates code testing and container compilation, Artifact Registry stores artifacts securely, Binary Authorization ensures image compliance, and Cloud Deploy coordinates multi-target progressive delivery with automated Cloud Monitoring rollback automation.

Step-by-Step Solution

1
Establish Continuous Integration and Security Controls
Cloud Build triggers automatically build container images upon code commits, push them to Artifact Registry, and generate Binary Authorization attestations based on Container Analysis security scans.
Ensures that only verified, vulnerability-scanned, and signed container images can be deployed to GKE clusters.
2
Configure Progressive Delivery with Cloud Deploy
Cloud Deploy receives the release artifact, managing progressive delivery (such as canary strategies) across staging and production targets with explicit promotion approvals.
Provides structured environment promotion and deployment strategy management tailored for GKE workloads.
3
Integrate Operational Monitoring for Automated Rollbacks
Cloud Deploy monitors deployment health indicators via Cloud Monitoring alerts and automatically initiates a rollback if deployment anomalies or errors occur.
Prevents faulty releases from degrading production availability without requiring manual intervention.

Key Concept

Cloud Build and Cloud Deploy Integration for Secure Automated Releases
Estimated Time:1m 30s
Rate this question

Topics

Continuous Integration and Continuous Delivery (CI/CD) Pipeline Design

More questions from this topic