PCD Building and testing applications — 20 Questions

Question 1

A company is developing a microservices application on Google Cloud. Each service is deployed as a Docker container on Cloud Run. The development team wants to ensure that inter-service communication is encrypted and authenticated. What is the best approach?

Accepted Answer

Use Cloud Run's built-in IAM-based authentication and automatic TLS for internal requests.. Cloud Run automatically provisions TLS certificates for all incoming requests and supports IAM-based authentication for internal requests between services in the same Google Cloud project. This means inter-service communication is encrypted by default via HTTPS and can be authenticated by configuring the receiving service to require a valid IAM token from the caller, without any additional infrastructure or sidecar proxies.

Answer

Configure mutual TLS (mTLS) between services using Cloud Endpoints.

Answer

Deploy a sidecar proxy on each Cloud Run service to handle TLS termination.

Answer

Assign a service account to each service and use its private key to sign requests.

Question 2

A developer is designing a CI/CD pipeline for a Node.js application hosted on Cloud Run using Cloud Build. The pipeline should run unit tests, build the container, push to Artifact Registry, and deploy to Cloud Run. The developer wants to minimize build time by caching dependencies. What is the recommended approach?

Accepted Answer

Use Cloud Build's built-in caching with a persistent volume to store node_modules between builds.. Option D is correct because Cloud Build supports built-in caching via persistent volumes (e.g., `/cache` or `/workspace`) that can store `node_modules` across builds. By configuring a cache volume in the `cloudbuild.yaml` and using `npm ci --prefer-offline`, the pipeline avoids re-downloading dependencies on every run, significantly reducing build time for Node.js applications on Cloud Run.

Answer

Run npm install locally and commit the node_modules folder to the repository for faster builds.

Answer

Use Cloud Build's step-level caching by copying the node_modules from a previous build step.

Answer

Create a custom base image that includes all dependencies and reference it in the Dockerfile.

Question 3

A developer needs to test a Cloud Function locally before deploying. Which tool should they use?

Accepted Answer

Functions Framework for your language.. The Functions Framework is the correct tool because it is an open-source library that allows you to run Cloud Functions locally on your machine, emulating the Cloud Functions runtime environment. This enables you to test your function's behavior, including HTTP triggers and event handling, without deploying to Google Cloud. Option D is correct because the Functions Framework is specifically designed for local development and testing of Cloud Functions.

Answer

Docker container with a custom entrypoint.

Answer

gcloud functions call command.

Answer

Cloud Code for VS Code or IntelliJ.

Question 4

A team is building a mobile backend on Google Cloud using Cloud Endpoints with Firebase Authentication. They want to protect their API from abuse by implementing rate limiting per user. What approach should they take?

Accepted Answer

Use Apigee API Management as a proxy to enforce rate limiting per developer app.. Apigee API Management is the correct choice because it provides built-in rate limiting policies that can be enforced per developer app, which maps directly to per-user rate limiting when Firebase Authentication is used. Cloud Endpoints does not natively support per-user rate limiting; it relies on the backend to implement such logic, which is not a managed solution. Apigee acts as a proxy that can inspect the Firebase-issued JWT token to identify the user and apply rate limits accordingly, offloading this concern from the backend code.

Answer

Implement rate limiting in the backend code and enforce it via Cloud Endpoints.

Answer

Configure Cloud Armor with a rule to block requests from users exceeding a threshold.

Answer

Use Cloud CDN with a cache key based on the user ID.

Question 5

A company is migrating a monolithic Java application to microservices on Google Kubernetes Engine (GKE). The application uses a shared MySQL database. The team wants to adopt a testing strategy that validates service interactions without deploying to a full cluster. Which testing approach is most appropriate?

Accepted Answer

Consumer-driven contract testing with tools like Spring Cloud Contract.. Consumer-driven contract testing (CDC) with tools like Spring Cloud Contract validates the interactions between microservices by defining and verifying API contracts (e.g., request/response formats, headers, status codes) without requiring a full GKE cluster. This approach is ideal for a migration from a monolithic Java application because it ensures that each service adheres to its expected behavior when communicating over HTTP or messaging, catching integration issues early in the development cycle. It does not require deploying to a cluster, making it faster and more lightweight than end-to-end testing.

Answer

Load testing to simulate production traffic.

Answer

Unit testing with mocked dependencies.

Answer

End-to-end testing in a staging environment.

Question 6

Which TWO statements about building container images for Google Cloud Run are correct? (Choose TWO.)

Accepted Answer

The container must respond to health checks on the same port as the main application.. Option B is correct because Cloud Run requires the container to respond to health checks (e.g., HTTP GET /health) on the same port as the main application. Cloud Run uses the same port for both user requests and health check probes; if the health check fails, the container is restarted. This ensures the container is always ready to serve traffic.

Answer

The container must use HTTP/1.1; HTTP/2 is not supported.

Answer

The container must listen on port 8080 by default.

Answer

The container must run as root user.

Question 7

Which THREE steps are required to set up a CI/CD pipeline for Cloud Run using Cloud Build and GitHub? (Choose THREE.)

Accepted Answer

Enable the Cloud Build, Cloud Run, and Artifact Registry APIs.. Options A, B, and D are required. Option C is optional; Cloud Build can connect to GitHub without a mirror. Option E is wrong because Artifact Registry is used, not Container Registry (deprecated).

Answer

Push the container image to Container Registry.

Answer

Mirror the GitHub repository to Cloud Source Repositories.

Question 8

A team is developing a microservice that processes messages from Pub/Sub. The service is deployed on Cloud Run and uses Cloud Firestore to store processed data. During load testing, the service frequently fails with 'DeadlineExceeded' errors from Firestore. What is the most likely cause and best practice to fix it?

Accepted Answer

Increase the Cloud Run container instance request timeout. The 'DeadlineExceeded' error from Firestore indicates that the Firestore client-side timeout has been exceeded, not the Cloud Run request timeout. However, the most likely cause is that the Cloud Run container instance request timeout (default 5 minutes) is too short for the processing time required, causing the instance to be terminated before the Firestore operation completes. Increasing the Cloud Run request timeout allows the container to wait longer for Firestore responses, preventing premature termination.

Answer

Increase the Pub/Sub subscription acknowledgment deadline

Answer

Enable CPU always allocation for the Cloud Run service

Answer

Add retry logic with exponential backoff for Firestore operations

Question 9

A developer needs to build a CI/CD pipeline that automatically tests and deploys a Node.js application to Cloud Run whenever a pull request is merged to the main branch. Which Google Cloud service should be used to trigger the pipeline?

Accepted Answer

Cloud Build. Cloud Build is the correct service because it is Google Cloud's fully managed CI/CD platform that can automatically trigger pipeline executions in response to repository events, such as a pull request merge to the main branch. By configuring a Cloud Build trigger with a source repository (e.g., Cloud Source Repositories, GitHub, or Bitbucket), the developer can define build steps to test the Node.js application and deploy it to Cloud Run using the `gcloud run deploy` command or a dedicated builder. This makes Cloud Build the native and most direct choice for building, testing, and deploying to Cloud Run in a single automated pipeline.

Answer

Cloud Functions

Answer

Cloud Deploy

Answer

App Engine

Question 10

A company deploys a Java application on Compute Engine with a preemptible VM instance group managed by an instance template. The application writes critical state to local SSD. After a preemption event, the new instance starts fresh and loses state. What is the best practice to ensure state persistence?

Accepted Answer

Refactor the application to write state to a persistent service like Cloud Storage. Option B is correct because local SSD data is ephemeral and lost on VM preemption or termination. Refactoring the application to write critical state to a persistent service like Cloud Storage ensures data durability independent of the VM lifecycle. This aligns with the best practice of designing preemptible workloads to be stateless, where state is stored externally.

Answer

Modify the startup script to recover state from a snapshot

Answer

Configure the managed instance group as stateful to preserve local SSD data

Answer

Use a regular (non-preemptible) VM instead of preemptible

Question 11

During a code review, a developer notices that the application's Cloud Storage client library is using the default credentials of the Compute Engine instance. What is a more secure alternative for a production environment?

Accepted Answer

Create a dedicated service account with minimal permissions and attach it to the instance. Option A is correct because creating a dedicated service account with minimal permissions and attaching it to the Compute Engine instance follows the principle of least privilege. This avoids using the overly permissive default Compute Engine service account, which often has broad access to many Google Cloud services. By scoping the service account to only the required Cloud Storage permissions (e.g., roles/storage.objectViewer), you reduce the attack surface and adhere to production security best practices.

Answer

Store user credentials in a configuration file

Answer

Use an API key for Cloud Storage

Answer

Generate an access token and embed it in the code

Question 12

A team is migrating a monolithic .NET application to Cloud Run. The application uses .NET Framework 4.8 and depends on Windows-specific libraries. What is the recommended approach to containerize and deploy this application?

Accepted Answer

Port the application to .NET Core/.NET 6+ and run on Linux. Cloud Run only supports Linux containers, so a .NET Framework 4.8 application that depends on Windows-specific libraries cannot be directly deployed. The recommended approach is to port the application to .NET Core/.NET 6+ (now .NET 8/9), which is cross-platform and can run on Linux containers, enabling deployment to Cloud Run. This aligns with Google's guidance for modernizing legacy .NET applications to leverage serverless platforms.

Answer

Deploy the application on Compute Engine with Windows Server

Answer

Use Cloud Run for Anthos on a Windows node pool

Answer

Use a Windows base image and deploy to Cloud Run

Question 13

Which TWO practices should be followed when integrating Cloud Endpoints with a Cloud Run service to enforce API authentication and rate limiting?

Accepted Answer

Set the audience field in the Endpoints service configuration to the Cloud Run service URL. Option B is correct because the `audience` field in the Endpoints service configuration must match the Cloud Run service URL (e.g., `https://myservice-xxxxx-uc.a.run.app`). This ensures that the JWT tokens issued by Google's authentication system are validated against the intended recipient, preventing token reuse across different services. Without this match, authentication will fail because the token's `aud` claim will not match the expected audience.

Answer

Use API keys to authenticate end users

Answer

Deploy Cloud Endpoints as a sidecar container in the same Cloud Run instance

Answer

Configure Cloud Armor rules to enforce rate limiting before requests reach Endpoints

Question 14

Which THREE steps are required to set up end-to-end testing for a Cloud Run service that uses Firestore and Pub/Sub?

Accepted Answer

Automate the teardown of test resources after test completion. Option A is correct because end-to-end testing of a Cloud Run service that interacts with Firestore and Pub/Sub must include automated teardown of test resources (e.g., Pub/Sub topics, subscriptions, Firestore documents) to prevent resource leaks and avoid incurring ongoing costs. Without teardown, leftover resources can cause quota exhaustion and interfere with subsequent test runs, making automation essential for reliable CI/CD pipelines.

Answer

Use the Cloud Run emulator to run the service locally

Answer

Use the Firestore emulator to simulate Firestore operations

Question 15

Refer to the exhibit. A developer deployed a Cloud Run service as shown. Authenticated requests from another service in the same project using a service account receive 403 Forbidden. What is the most likely cause?

Accepted Answer

The service account used to authenticate is not granted the roles/run.invoker role on the Cloud Run service. Option C is correct because the Cloud Run service requires the IAM role `roles/run.invoker` on the service itself for any principal (including a service account) to invoke it. Since the service was deployed with `--no-allow-unauthenticated`, only explicitly granted principals can invoke it. The service account used for authentication lacks this role, causing the 403 Forbidden response.

Answer

The Cloud Run service requires the 'allAuthenticatedUsers' member to be added

Answer

The --no-allow-unauthenticated flag blocks all requests including authenticated ones

Answer

The container image was built without proper authentication headers

Question 16

Refer to the exhibit. A developer is configuring Cloud Build to build a Docker image from a Cloud Source Repository. The build fails with a permission error. What is the most likely reason?

Accepted Answer

The service account is missing the roles/source.reader role to access the repository. The build fails with a permission error because the Cloud Build service account does not have the `roles/source.reader` role on the Cloud Source Repository. Without this role, the service account cannot read the source code from the repository, which is required to trigger the build. The error is not about building permissions but about accessing the source.

Answer

The service account lacks the roles/cloudbuild.builds.builder role

Answer

The Cloud Source Repository does not have the build trigger enabled

Answer

The build config file is missing the 'source' field

Question 17

A developer is building a CI/CD pipeline for a microservices application. The pipeline should build a container image, run unit tests, and deploy to Google Kubernetes Engine (GKE) only if all tests pass. Which Google Cloud service is best suited for orchestrating this pipeline?

Accepted Answer

Cloud Build. Cloud Build is the correct choice because it is a fully managed CI/CD platform that natively supports building container images, running unit tests, and deploying to GKE. It can be configured with a cloudbuild.yaml file to define steps for building, testing, and deploying, and it only proceeds to the deploy step if all prior steps (including tests) succeed. This makes it the best fit for orchestrating the entire pipeline in a single, integrated service.

Answer

Compute Engine

Answer

Cloud Run

Answer

Cloud Functions

Question 18

A team uses Cloud Source Repositories for version control and Cloud Build for CI. The build configuration file (cloudbuild.yaml) includes a step that runs unit tests. The team wants to ensure that the build fails if any test fails. What should the developer do?

Accepted Answer

Ensure the test command in the build step returns a non-zero exit code when tests fail.. Option B is correct because Cloud Build executes each step as a container, and the build step's success or failure is determined by the exit code of the command run inside that container. If the test command (e.g., `npm test` or `pytest`) returns a non-zero exit code when tests fail, Cloud Build will automatically mark that step as failed and stop the build. No special configuration or custom builder is required beyond ensuring the test command itself propagates the failure exit code.

Answer

Use Cloud Build's built-in test runner that automatically fails the build on test failure.

Answer

Create a custom builder that runs tests and emits a non-zero exit code on failure.

Answer

Add a pre-build step that checks test results and triggers a build failure if needed.

Question 19

An application running on Compute Engine uses Cloud Storage for storing user-uploaded images. During load testing, the application experiences high latency when reading images. The developer suspects that the application is making too many small read requests. Which approach should the developer take to optimize performance?

Accepted Answer

Increase the read size to reduce the number of API requests.. Option C is correct because the high latency is caused by many small read requests, each incurring API overhead. By increasing the read size (e.g., reading larger chunks or using range requests), the application reduces the number of API calls, which lowers cumulative latency and improves throughput. This directly addresses the root cause of excessive small reads.

Answer

Enable Cloud CDN to cache the images at edge locations.

Answer

Rewrite the objects to use a different storage class.

Answer

Mount the Cloud Storage bucket using Cloud Storage FUSE and read files from the local filesystem.

Question 20

A developer is deploying a new version of a microservice to Cloud Run. The developer wants to ensure that the new revision is tested with a small percentage of traffic before rolling out to all users. Which TWO approaches can the developer use?

Accepted Answer

Use the 'gcloud run deploy' command with '--no-traffic' and then use 'gcloud run services update-traffic --to-revisions=REVISION=5' to send 5% of traffic.. Option A is correct because the '--no-traffic' flag deploys the new revision without serving any traffic, and then 'gcloud run services update-traffic --to-revisions=REVISION=5' allows you to send exactly 5% of traffic to that revision for canary testing. Option B is also correct because it describes the same two-step process: deploy with '--no-traffic' to avoid immediate traffic, then use 'update-traffic' to gradually increase the percentage, which is the standard canary deployment pattern on Cloud Run.

Answer

Set the 'max-instances' parameter to limit the number of instances handling requests.

Answer

Use the 'gcloud run deploy' command with '--tag' to assign a tag to the new revision, then direct test traffic to that tag.

Answer

Deploy the new revision with the same revision name as the old one to overwrite it, then roll back if issues occur.