Artifact Registry creation in GCP - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Configuration

intermediate

Creating a Docker repository in Artifact Registry

You want to create a Docker repository named my-docker-repo in Artifact Registry within the us-central1 region. Which gcloud command correctly creates this repository?

A gcloud artifacts repositories create my-docker-repo --repository-format=docker --location=us-east1

B gcloud artifacts repositories create my-docker-repo --repository-format=maven --location=us-central1

C gcloud artifacts repositories create my-docker-repo --repository-format=docker --location=us-central1

D gcloud artifacts repositories create my-docker-repo --repository-format=container --location=us-central1

💡 Hint

Remember that Docker repositories use the 'docker' format and location must match your desired region.

The correct command uses '--repository-format=docker' and '--location=us-central1' to create a Docker repository in the specified region. Option C uses the wrong format 'maven'. Option C uses the wrong location 'us-east1'. Option C uses an invalid format 'container'.

❓ Architecture

intermediate

Choosing Artifact Registry location for multi-region access

Your team is distributed across multiple continents and needs fast access to container images stored in Artifact Registry. Which location type should you choose to optimize latency and availability?

A Choose a single-region location closest to your main office

B Choose a multi-region location that covers all your users

C Create multiple single-region repositories in each continent

D Use a regional location but replicate images manually

💡 Hint

Think about how Google Cloud manages multi-region locations for global access.

Multi-region locations provide automatic replication and low latency access across a wide area, making them ideal for distributed teams. Single-region locations limit access speed to that region. Creating multiple single-region repositories increases management complexity. Manual replication is error-prone and inefficient.

❓ security

advanced

Configuring IAM permissions for Artifact Registry access

You want to allow a service account to push and pull Docker images from an Artifact Registry repository named prod-repo. Which IAM role should you assign to the service account for the least privilege?

A roles/storage.objectAdmin

B roles/artifactregistry.admin

C roles/artifactregistry.reader

D roles/artifactregistry.writer

💡 Hint

Consider the difference between read, write, and admin roles.

The 'roles/artifactregistry.writer' role allows pushing and pulling images, which is the least privilege needed. 'roles/artifactregistry.admin' grants full control, which is more than needed. 'roles/artifactregistry.reader' only allows pulling images. 'roles/storage.objectAdmin' is unrelated to Artifact Registry permissions.

❓ service_behavior

advanced

Understanding Artifact Registry image versioning behavior

You push a Docker image tagged v1.0 to an Artifact Registry repository. Later, you push another image with the same tag v1.0 but different content. What happens to the stored images?

A The new image overwrites the old image with tag v1.0; only one image with that tag exists.

B Both images are stored separately with the same tag v1.0 pointing to the latest image.

C Artifact Registry rejects the second push because the tag v1.0 already exists.

D The old image is deleted and the new image is stored with a new unique tag.

💡 Hint

Think about how Docker tags work in registries.

Docker tags are mutable pointers to image digests. Pushing a new image with the same tag updates the tag to point to the new image, effectively overwriting the previous tag reference. The old image may still exist by digest but is no longer referenced by that tag. Artifact Registry allows tag updates and does not reject pushes with existing tags.

✅ Best Practice

expert

Implementing secure Artifact Registry access in CI/CD pipelines

You want to securely authenticate your CI/CD pipeline to push images to Artifact Registry without embedding long-lived credentials. Which approach follows best security practices?

A Use Workload Identity Federation to allow the pipeline to impersonate a service account without keys.

B Use a service account key file stored in the pipeline repository and authenticate with it.

C Store the service account password as a secret in the pipeline and use it for authentication.

D Use user credentials from a developer's account to authenticate the pipeline.

💡 Hint

Consider how to avoid long-lived keys and manual credential management.

Workload Identity Federation allows external identities (like those from CI/CD systems) to impersonate Google service accounts without needing to manage or store long-lived keys, improving security. Using key files or passwords stored in repositories or secrets increases risk. Using developer user credentials is insecure and not recommended.