FirstTry

Objective 2.3

PCDE

Managing pipeline configuration and secrets

Objective 2.3 sits in Building and implementing CI/CD pipelines, including continuous testing, which carries 25% of the Cloud DevOps Engineer exam. The questions below are original, written from the official objective title above, and each explanation cites the Google Cloud page it rests on.

Objective title verbatim from the official objectives. Google Cloud exam page ↗

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

2-3Building and implementing CI/CD pipelines, including continuous testing

An engineer adds a secret to secretEnv and now needs to use it inside the args of that step. How is it written there?

As the bare variable name with no prefixA bare name would be read as a build substitution and replaced before the step runs.
As the full secret version resource pathThe resource path belongs in the availableSecrets block rather than the argument string.
As a substitution wrapped in curly bracesCurly braces are not the notation here, and the value is not a substitution at all.
As the variable name prefixed with two dollarsCorrect · your answerCorrect: doubling escapes the substitution layer.

Correct.

Concept

A value that only exists at run time must be escaped from whatever templating layer runs first, or the earlier layer consumes the reference and the step never sees the value.

Why D

Inside the argument string the environment variable is written with a doubled sigil, which distinguishes it from a build substitution and leaves it to be resolved by the shell in the step.

Source

When specifying the secret in the args field, specify it using the environment variable prefixed with $$

Google Cloud: Use secrets from Secret Manager, checked August 2026
#cloud-build#secret-manager#build-config

Now you: objective 2.3 questions

No account needed. The explanation opens when you answer.

Sample question 1 of 3

2-3Building and implementing CI/CD pipelines, including continuous testing

A team's build fails to read a secret. Which role must the build's service account hold on that secret?

Sample question 2 of 3

2-3Building and implementing CI/CD pipelines, including continuous testing

A team adds secretEnv to a build step and the environment variable resolves to nothing. Which field did they leave out?

Sample question 3 of 3

2-3Building and implementing CI/CD pipelines, including continuous testing

A team needs a non-UTF-8 secret inside a build step. Which approach does Cloud Build support for that case?

Full Cloud DevOps Engineer question bank coming

We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.

More objectives in Building and implementing CI/CD pipelines, including continuous testing