Google PCA Practice Question: Managing and Provisioning a Solution Infrastructure
A team is using Cloud Build to deploy a microservice to Cloud Run. They want to ensure that only containers built from a specific trusted branch in their source repository are deployed to production. Which Cloud Build feature should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud Build trigger branch filtering
Cloud Build triggers can be configured to respond only to specific branches (e.g., 'main' or 'release/*'). By setting the trigger's included files filter and branch regex, they can restrict builds to that branch. Artifact Registry controls access to container images, but does not restrict deployment by branch. Cloud Deploy is a separate service for progressive delivery. Binary Authorization enforces policies at deployment time but does not filter by branch.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Binary Authorization attestors
Why it's wrong here
Binary Authorization uses attestors to verify container provenance, not branch filtering.
- ✓
Cloud Build trigger branch filtering
Why this is correct
Cloud Build triggers can be scoped to specific branches using regex, ensuring only trusted branches trigger builds.
- ✗
Cloud Deploy delivery pipeline approvals
Why it's wrong here
Cloud Deploy handles rollout progression with approval gates, but does not filter containers based on source branch.
- ✗
Artifact Registry IAM permissions
Why it's wrong here
Artifact Registry controls who can push/pull images, but does not restrict deployment by source branch.
Go deeper
Related to this question
Learn chapter
Introduction to Google Cloud Platform
Key term
Artifact Registry
Artifact Registry is a managed service for storing, managing, and securing container images and other software packages in a centralized repository.
Key term
Binary Authorization
Binary Authorization is a security control that ensures only trusted container images are deployed in a Kubernetes or cloud environment.
About these practice questions
Courseiva writes every PCA question from scratch — 955 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.