Chapter 2 of 5 · Google Cloud Professional Cloud DevOps Engineer
Building and implementing CI/CD pipelines
Triggers, approvals, deployment strategies, troubleshooting, secrets and supply chain security.
- 4topics
- 22 minfast track
- 2diagrams and exhibits
- 25%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Designing CI/CD Pipelines for Apps, Infrastructure and MLDesign CI/CD pipelines on Google Cloud for apps, infrastructure and ML: Artifact Registry, hybrid targets, Cloud Build triggers…5 min
- 2Deployment Strategies, Auditing Deployments and TroubleshootingCanary, blue/green, rolling, traffic splitting and feature flags on Google Cloud, success metrics, deployment auditing and fixing…Diagram6 min
- 3Cloud KMS, Secret Manager, Parameter Manager and Secret InjectionManage pipeline secrets and config on Google Cloud: Cloud KMS, Secret Manager, Certificate Manager, Parameter Manager and…5 min
- 4Artifact Analysis, Binary Authorization, SLSA and Pipeline IAMSecure the deployment pipeline with Artifact Analysis scanning, Binary Authorization, SLSA build provenance and IAM policies for…Diagram6 min
About this chapter
What this chapter covers
Building and implementing CI/CD pipelines, including continuous testing, for application, infrastructure, and machine learning workloads is about 25% of the Google Cloud Professional Cloud DevOps Engineer exam. It is one of the two largest sections, and it is about running pipelines well, not only drawing them.
It covers designing pipelines (CI/CD for applications, infrastructure and ML, artifact management in Artifact Registry, hybrid and multi-cloud targets, triggers and approval flows), implementing and managing pipelines (auditing deployments, canary, blue/green, rolling, traffic splitting and feature flags, success metrics, troubleshooting), configuration and secrets (Cloud KMS, Secret Manager, Certificate Manager, Parameter Manager, Workload Identity Federation, build versus runtime injection) and securing the pipeline (Artifact Analysis, Binary Authorization, SLSA and IAM per environment).
The exam has 50 to 60 multiple choice and multiple select questions in 2 hours. Questions here often describe a failed or risky release and ask which strategy, gate or setting reduces the risk, ending "What should you do?".
How the topics fit together
Design decides the stages and gates. Secrets, scanning and attestations protect each stage, and telemetry from the rollout decides whether a release moves forward or goes back.
Look for the answer that keeps the same artifact moving through every stage and makes rollback a single step. Rebuilding per environment or editing production by hand is almost never correct.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with tables and code examples.
- What to remember for the exam: the facts to memorise and how questions are phrased.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Ready for more practice?
The full Google Cloud Professional Cloud DevOps Engineer question bank has 751 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Google Cloud. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.