Courseiva
← GCDL
Full test
Google Cloud products, services, and solutions →mediumMultiple ChoiceObjective-mapped

Cloud Digital Leader Practice Question: Google Cloud products, services, and solutions

A development team uses Cloud Build to automatically build, test, and create container images whenever code is pushed to their repository. The resulting Docker images need to be stored securely and made available to their GKE deployment pipelines. Which Google Cloud service stores and manages these container images?

⚠ Common exam trap

Many candidates confuse Cloud Storage (a generic object store) with a container registry, not realizing that container images require a registry API and metadata management that Artifact Registry provides.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Artifact Registry

Artifact Registry is the correct service because it is a fully managed, private container registry designed to store, manage, and secure Docker images and other artifacts. It integrates natively with Cloud Build for pushing images and with GKE for pulling them, supporting vulnerability scanning and IAM-based access control.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    Cloud Storage bucket with a `containers/` folder.

    Why it's wrong here

    Cloud Storage is a generic object store that treats files as immutable blobs, but a Docker registry is more than a folder: it must implement the OCI Distribution API for manifests, blobs/layers, and authentication during push/pull. Storing images under a `containers/` prefix would lack the registry protocol that tools like Cloud Build and GKE expect, so clients would need custom `docker`-compatible wrappers. Artifact Registry natively implements this API, handles image digests, and provides vulnerability scanning, making a raw bucket unsuitable for production deployments.

  • ✓

    Artifact Registry

    Why this is correct

    Artifact Registry is Google Cloud's managed service for OCI-compliant artifacts, including Docker/OSContainer images, Maven packages, and Helm charts. It stores each image as manifests plus content-addressed layers, and it integrates with Cloud Build for pushes and with GKE, Cloud Run, or Anthos clusters for authenticated pulls. Built-in features like per-format IAM roles, Customer-Managed Encryption Keys, and container vulnerability scanning make it the correct destination for build artifacts that feed deployments.

  • ✗

    Cloud SQL — storing build artifacts in a relational database.

    Why it's wrong here

    Cloud SQL provides managed MySQL, PostgreSQL, or SQL Server instances optimized for transactional queries and structured data with row/column semantics. Container images are composed of immutable binary layers identified by SHA-256 digests, not relational tables, and forcing them into a database would introduce huge storage bloat and slow read/write operations without any registry-compatible protocol. There is also no OCI API surface in Cloud SQL, so clients like `docker pull` cannot consume images directly from it; Artifact Registry exists specifically for this binary artifact use case.

  • ✗

    Cloud Source Repositories — the code repository stores both source code and container images.

    Why it's wrong here

    Cloud Source Repositories (CSR) is a Git hosting service designed for version-controlled source code, branch history, and pull requests; it stores text/diff data, not compiled binaries. A container image is a build output that combines base layers, application code, and runtime libraries into an OCI artifact, and attempting to commit it to Git would bloat the repository enormously while losing layer deduplication and digest-based referencing. CSR cannot serve the OCI Distribution API for pushing or pulling images, so Cloud Build pushes to Artifact Registry, not back to the source repo.

About these practice questions

Courseiva writes every GCDL question from scratch — 829 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.