Google Professional Cloud DevOps Engineer Question 48
Select 2Google Cloud PlatformYour team is adopting Google Cloud Workstations to streamline development workflows and ensure consistency across environments. You need to configure a Cloud Workstation environment that allows developers to use pre-installed tools, access private repositories hosted on Google Cloud Source Repositories, and ensure secure connections to these repositories. Which steps should you include in the configuration process?
- A
Create a Cloud Workstation configuration and specify an image that includes pre-installed tools required by your team.
- B
Enable Identity-Aware Proxy (IAP) for the Cloud Workstation to enforce secure access.
- C
Grant the 'Source Repository Reader' role to the Cloud Workstations service account to access private repositories.
- D
Configure a firewall rule to allow HTTP traffic from any source to the Cloud Workstation instance.
- E
Use a custom startup script to clone private repositories and set up authentication tokens for developers.
Show answer and explanation
Correct answers: A, C
Explanation
To configure a secure and functional Cloud Workstation environment, you need to ensure that the necessary tools are pre-installed by specifying the correct image in the configuration, and provide the appropriate IAM role ('Source Repository Reader') to the service account to enable secure access to private repositories. Other options, such as configuring IAP or using HTTP firewall rules, are either unnecessary or could compromise security.
- A. Correct.
This is correct. Cloud Workstations configurations allow you to specify a custom container image or predefined image with the necessary tools pre-installed, ensuring consistency across development environments.
- B. Incorrect.
This is incorrect. Identity-Aware Proxy (IAP) is not required specifically for Cloud Workstations. Cloud Workstations already use IAM policies to control access securely.
- C. Correct.
This is correct. Granting the 'Source Repository Reader' role to the Cloud Workstations service account allows it to securely access private repositories in Google Cloud Source Repositories.
- D. Incorrect.
This is incorrect. Configuring a firewall rule to allow HTTP traffic from any source to the Cloud Workstation instance is unnecessary and would pose a security risk.
- E. Incorrect.
This is incorrect. While startup scripts can be used, they are not the best practice for securely accessing private repositories. Instead, proper role-based access should be configured.