Google PCA Practice Question: Managing and Provisioning a Solution Infrastructure
A team is using Cloud Build to deploy a microservice to Cloud Run. They want to ensure that only containers built from a specific trusted branch in their source repository are deployed to production. Which Cloud Build feature should they use?
⚠ Common exam trap
PCA often tests the difference between source-side controls (trigger branch filtering) and deploy-side controls (Binary Authorization, Cloud Deploy approvals) — candidates frequently pick Binary Authorization because it sounds more 'secure' but it does not filter by branch.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud Build trigger branch filtering
Cloud Build triggers support branch filtering via the 'Branch' field (regex) in the trigger configuration, so a trigger can be scoped to only fire on pushes to a specific branch such as 'refs/heads/main' or 'release/*'. This ensures that only builds originating from the trusted branch proceed to the deploy step, satisfying the requirement with a native Cloud Build feature.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Binary Authorization attestors
Why it's wrong here
Binary Authorization attestors verify that an image satisfies a policy before deployment; they do not inspect the source branch that produced it. It is tempting because attestors enforce trusted-image admission, and Binary Authorization is correct when you must prove an image passed a vulnerability scan or build attestation.
- ✓
Cloud Build trigger branch filtering
Why this is correct
Branch filtering restricts a trigger to builds originating from a named branch, so only commits from the trusted branch fire the deploy pipeline. This directly enforces the stem's constraint that production deploys come solely from that trusted source branch.
- ✗
Cloud Deploy delivery pipeline approvals
Why it's wrong here
Cloud Deploy approvals gate promotion between delivery pipeline stages, not which source branch Cloud Build may build from. It is tempting because approvals enforce production release control, and Cloud Deploy is correct when you need manual sign-off before deploying an already-built image to a target environment.
- ✗
Artifact Registry IAM permissions
Why it's wrong here
Artifact Registry IAM controls who may push or pull images, not which branch produced them. It is tempting because restricting production pulls to trusted identities is a genuine control, and Artifact Registry IAM is correct when the requirement is limiting which service accounts can access a repository.
Go deeper
Related to this question
Learn chapter
Cloud Build and CI/CD Pipelines
Key term
Cloud Build
Cloud Build is a managed service that compiles source code into deployable artifacts, often used in continuous integration and continuous delivery pipelines.
Key term
Cloud Run
Cloud Run is a fully managed compute platform from Google Cloud that lets you run containerized applications in a serverless environment, automatically scaling from zero to thousands of requests.
About these practice questions
Courseiva writes every PCA question from scratch — 807 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Google Cloud exam blueprint
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.