GCP Professional Cloud DevOps Engineer Practice Question 9: Secure Cloud Development Environments
Google Cloud Professional Cloud DevOps Engineer · Test 1 · question 9 of 10
An organization is onboarding forty contract developers for a six-month project. Source code must never be stored on contractor laptops, every developer must get an identical preconfigured toolchain that the platform team controls centrally, the environment must reach an internal Git server that is only reachable on private VPC addresses, and idle environments must shut down automatically to limit cost.
Which option best satisfies these requirements?
Show answer and explanation
Answer:
Cloud Workstations is the managed service for exactly this problem. The platform team defines a workstation *configuration*, a template naming a custom container image, machine type, persistent home disk, and network, and each developer gets a workstation instantiated from it, so everyone runs the same admin-controlled toolchain and updates to the configuration apply on the next restart. Workstation clusters attach to a VPC, so private-only internal services such as the Git server are reachable, and access is governed by IAM. Code lives on the workstation's persistent disk rather than on the laptop, since developers connect through the browser IDE, a local VS Code or JetBrains IDE, or SSH. Administrators set idle and running timeouts so unused workstations stop on their own.
Option A does not scale to a controlled fleet. Cloud Shell is an ephemeral environment with a modest persistent home directory, intended for administrative work; reinstalling a toolchain per session is slow and drifts, and it is not the mechanism for a platform team to publish and version a standard image for forty people.
Option B rebuilds Cloud Workstations by hand and does it less safely. External IPs and SSH widen the attack surface, image updates must be rolled out VM by VM, and relying on developers to stop their own instances is exactly the manual step an idle timeout removes.
Option D places source code on unmanaged contractor laptops, which the stem forbids, and a documented script guarantees divergence between forty machines rather than a controlled identical environment.
Reference: Cloud Workstations overview