FirstTry

Objective 2.4

PCDE

Securing the deployment pipeline

Objective 2.4 sits in Building and implementing CI/CD pipelines, including continuous testing, which carries 25% of the Cloud DevOps Engineer exam. The questions below are original, written from the official objective title above, and each explanation cites the Google Cloud page it rests on.

Objective title verbatim from the official objectives. Google Cloud exam page ↗

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

2-4Building and implementing CI/CD pipelines, including continuous testing

A security team asks what an attestation actually stores about an image. Which description matches?

The registry path and digest, digitally signedCorrect · your answerCorrect: a signed pointer, not the artifact.
A vulnerability report produced by the scannerScan findings come from the analysis service and are a separate input to a policy.
The build log signed by the CI service accountLogs are evidence a human reads, and the record verified at deploy time is far smaller.
The full image layers with a checksum appendedNothing about the image content travels in the record; only an identifier for it does.

Correct.

Concept

A claim about an artifact only means something if it names the exact artifact and cannot be forged. Pointing at an immutable identifier and signing the pointer makes the claim transferable between stages.

Why A

It is a small record naming where the image lives and which exact content it has, carrying a signature from the private key of whoever vouched for it.

Source

The attestation is a record that contains the registry path and digest of the image, and that has been digitally signed using the signer's private cryptographic key.

Google Cloud: Binary Authorization overview, checked August 2026
#binary-authorization#attestations#supply-chain

Now you: objective 2.4 questions

No account needed. The explanation opens when you answer.

Sample question 1 of 3

2-4Building and implementing CI/CD pipelines, including continuous testing

A team enables continuous validation over running Pods. What does the service do when an image no longer conforms?

Sample question 2 of 3

2-4Building and implementing CI/CD pipelines, including continuous testing

An engineer needs to find out why a deployment was refused by policy. Where is the reason written?

Sample question 3 of 3

2-4Building and implementing CI/CD pipelines, including continuous testing

A team worries that gating deployments will re-run their whole test suite at deploy time. What happens instead?

Full Cloud DevOps Engineer question bank coming

We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.

More objectives in Building and implementing CI/CD pipelines, including continuous testing