PCD Building and testing applications Practice Test 10 — 15 Questions

Question 1

A developer is writing unit tests for a Python application that will run on Cloud Functions. The function makes HTTP requests to an external API. The developer wants to avoid making actual network calls during tests. What should the developer use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Mock the HTTP requests using a library like unittest.mock.. `unittest.mock` allows the developer to replace the actual HTTP request calls (e.g., `requests.get`) with mock objects that return controlled responses, preventing any real network traffic. This is essential for unit testing Cloud Functions where external API calls must be isolated to ensure tests are fast, deterministic, and do not depend on external services.

Answer

Use a test double to replace the entire function.

Answer

Use dependency injection to pass a fallback URL.

Answer

Deploy the function to Cloud Functions and run integration tests.

Question 2

A team uses Cloud Build to build and deploy a Node.js application to App Engine flexible environment. The build succeeds, but the deployment fails with 'ERROR: (gcloud.app.deploy) Error Response: [9] Application startup error!' The team checks logs and sees 'Error: Module not found: 'express''. What is the most likely cause?

Accepted Answer

The dependencies are not installed during the build step before deploying.. The error 'Module not found: express' indicates that the Node.js dependencies (specifically the 'express' package) are not present in the deployed application. In Cloud Build, the build steps must explicitly install dependencies (e.g., via 'npm install') before the deploy step. If the build configuration does not include an 'npm install' step, the dependencies listed in package.json are not copied to the App Engine flexible environment, causing the startup error.

Answer

The build step includes 'npm test' which fails.

Answer

The Node.js version specified in app.yaml is incompatible with the dependencies.

Answer

The app.yaml file is missing from the root of the repository.

Question 3

A developer is writing integration tests for a Cloud Function that uses Cloud Firestore. The tests must run in a local environment without incurring costs or affecting production data. What should the developer use?

Accepted Answer

Use the Firestore emulator running locally.. The Firestore emulator, part of the Firebase Local Emulator Suite, allows integration tests to run entirely on the local machine without network calls to GCP. This avoids incurring costs and prevents any impact on production data, as all operations are performed against an in-memory Firestore instance that mimics the real service's behavior.

Answer

Create a separate GCP project for testing and use its Firestore.

Answer

Mock the Firestore client library calls.

Answer

Run tests against the production Firestore instance with a test prefix.

Question 4

An organization uses Cloud Build to deploy multiple microservices to GKE. They want to ensure that the deployment process can be audited and that each deployment can be rolled back to a previous version. What is the recommended approach?

Accepted Answer

Use Cloud Deploy to manage deployments with rollback capabilities and audit logs.. Cloud Deploy is the recommended service for managing progressive deliveries and rollbacks on GKE, as it provides built-in rollback capabilities, audit logging, and delivery pipeline management. Unlike raw Kubernetes Deployment history, Cloud Deploy integrates with Cloud Build and offers a controlled, auditable deployment process with the ability to roll back to any previous release revision.

Answer

Use Kubernetes Deployment history to rollback by specifying a revision.

Answer

Store each manifest version in Artifact Registry and manually apply kubectl.

Answer

Use Cloud Build to redeploy a previous image tag when rollback is needed.

Question 5

Which THREE of the following are best practices for building secure applications on Google Cloud?

Accepted Answer

Use Secret Manager to manage sensitive configuration values.. Option A is correct because Secret Manager is Google Cloud's managed service for storing, versioning, and accessing sensitive configuration values such as API keys, passwords, and certificates, keeping them out of source code and environment variables while enforcing IAM-based access. Option D is correct because VPC Service Controls create a security perimeter around Google Cloud services and resources, which mitigates data exfiltration risks by restricting access from outside the perimeter and blocking unauthorized data movement. Option E is correct because storing source code in Cloud Source Repositories with IAM restrictions ensures that only authorized identities can read or modify code, protecting intellectual property and preventing tampering with the application supply chain. Option B is not a best practice because disabling authentication on a Cloud Run service exposes it publicly, allowing anyone to invoke it and potentially abuse resources or access data. Option C is not a best practice because using a single service account for all Cloud Functions violates least privilege; each function should have its own service account with only the permissions it needs.

Answer

Disable authentication on a test Cloud Run service for end-user testing.

Answer

Use a single service account for all Cloud Functions to simplify permissions.

Question 6

Which THREE of the following are valid reasons to use Cloud Deploy instead of manually applying kubectl commands in a CI/CD pipeline?

Accepted Answer

Cloud Deploy maintains a deployment history for auditing.. Option B is correct because Cloud Deploy records each rollout and release in a delivery pipeline, giving a persistent, auditable deployment history that manual kubectl commands do not provide. Option D is correct because Cloud Deploy can automatically roll back a failed rollout to the last known-good release, whereas manual kubectl apply offers no built-in rollback automation. Option E is correct because Cloud Deploy natively supports progressive delivery strategies such as canary and blue-green through its rollout configuration, which would otherwise require custom scripting with kubectl. Option A is not correct because Cloud Deploy deploys already-built container images to GKE, Cloud Run, or Anthos; it does not build or containerize applications (that is Cloud Build or Buildpacks). Option C is not correct because IAM roles on Kubernetes clusters are enforced by GKE/IAM itself, not by Cloud Deploy as a deployment mechanism.

Answer

Cloud Deploy automatically containerizes applications.

Answer

Cloud Deploy enforces IAM roles on Kubernetes clusters.

Question 7

You are a Cloud Developer working for an e-commerce company. The company uses Cloud Build to build and deploy a Python application to App Engine standard environment. The application uses Cloud SQL for its database. The team recently updated the application code and added a new dependency. The build succeeds, but the deployment fails with 'Error Response: [9] Application startup error!' You check the logs and see 'ImportError: No module named requests'. The team uses a requirements.txt file. However, the requirements.txt file has been configured correctly in the past. The team also uses a custom runtime config in app.yaml with a 'entrypoint' field. They did not change any configuration files. What is the most likely cause of this error?

Accepted Answer

The custom entrypoint in app.yaml bypasses the automatic installation of dependencies.. The error 'ImportError: No module named requests' indicates the new dependency was not installed. In App Engine standard, when a custom `entrypoint` is specified in app.yaml, App Engine does not automatically install dependencies from requirements.txt; the entrypoint overrides the default build/start behavior that would normally run pip install. Since the team added a new dependency and uses a custom entrypoint, the dependency is not installed. The runtime is not the cause because no configuration files were changed and requirements.txt was previously working.

Answer

The app.yaml file incorrectly specifies 'runtime: python27' but the code uses Python 3, and python27 does not automatically install dependencies from requirements.txt.

Answer

The app.yaml file specifies 'runtime: python39' which is not supported by App Engine standard.

Answer

The requirements.txt file is missing from the deployment directory.

Question 8

A team is using Cloud Spanner for a global application. They notice that read latency is high for queries that filter on a non-key column. The table has a primary key of (CustomerID, OrderDate) and there are millions of rows. The query uses a WHERE clause on the 'Status' column. The team wants to reduce latency without significantly increasing storage costs. What is the most effective action?

Accepted Answer

Create a secondary index on the 'Status' column.. Creating a secondary index on the 'Status' column (Option B) allows Cloud Spanner to directly locate rows matching the filter without scanning the entire table. This reduces read latency because Spanner can use the index to perform a point lookup or small range scan instead of a full table scan. Indexes in Spanner are stored as separate tables, but they add minimal storage overhead compared to the latency improvement they provide.

Answer

Create an interleaved table for 'Status' values.

Answer

Increase the number of nodes in the Spanner instance.

Answer

Use stale reads with a 15-second staleness.

Question 9

A company serves static content (images, CSS) through a Cloud Load Balancer with Cloud CDN enabled. They release a new version of the website with updated image assets. After deployment, users still see old images, even though the new image files are served from the backend. The team has already invalidated the cache for the directory containing the images using the Cloud CDN invalidation feature with a specific path. However, the old images persist. What is the most effective additional step to ensure users see the new images?

Accepted Answer

Use a wildcard in the Cloud CDN invalidation path (e.g., /images/*).. Cloud CDN cache invalidation requires exact path matching unless a wildcard is used. The team invalidated a specific path but likely missed the exact paths of the cached image files. Using a wildcard like `/images/*` ensures all objects under the `/images/` directory are invalidated, forcing the CDN to fetch the updated images from the backend.

Answer

Set the cache TTL for the image directory to 0 seconds.

Answer

Change the load balancer cache mode to 'FORCE_CACHE_ALL'.

Answer

Configure cache key parameters to ignore query strings.

Question 10

A development team is building a containerized application on Google Cloud. They want to implement a CI/CD pipeline that automatically builds and tests their application on every push to the main branch. Which TWO actions should they take to achieve this?

Accepted Answer

Configure a Cloud Build trigger to run on push events to the main branch.. Cloud Build triggers can be configured to automatically start a build whenever a push event occurs on a specific branch, such as main. This is the standard way to initiate a CI/CD pipeline in response to code changes in Google Cloud.

Answer

Enable Cloud Run for Anthos to automatically deploy after build.

Answer

Use Cloud Scheduler to trigger a Cloud Build trigger every 5 minutes.

Answer

Create a Cloud Source Repository and use Cloud Functions to build on push.

Question 11

Refer to the exhibit. A developer creates this cloudbuild.yaml for a Cloud Build pipeline. When they run the build, they get an error that the image push failed. What is the most likely cause?

Accepted Answer

The Artifact Registry repository 'my-repo' has not been created.. The error occurs because the cloudbuild.yaml references an Artifact Registry repository 'my-repo' that does not exist in the project. Cloud Build attempts to push the Docker image to the specified repository, and if the repository has not been created, the push fails with a permission or not-found error. The repository must be created before the build runs, as Cloud Build does not automatically create repositories.

Answer

The project ID 'my-project' does not exist.

Answer

The Dockerfile is missing in the repository.

Answer

Cloud Run service 'my-service' already exists and needs to be deleted.

Answer

The gcloud command requires the '--platform managed' flag.

Question 12

A developer is writing a Cloud Run service that receives Pub/Sub push messages. The service must verify that incoming requests genuinely originate from Pub/Sub before processing the message. The developer wants to implement this verification in code. Which approach should they use?

Accepted Answer

Validate the OIDC JWT in the Authorization header against Google's public keys, checking the email claim equals the service account used by the Pub/Sub subscription.. Pub/Sub push subscriptions configured with authentication send an OIDC JWT in the Authorization header. Verifying the signature against Google's public keys and checking that the email claim matches the service account bound to the subscription is the supported way to confirm authenticity. This prevents unauthorized clients from injecting messages into the service.

Answer

Compare the source IP address of the request against the published list of Google Cloud Pub/Sub egress ranges.

Answer

Check that the request contains a custom header X-Goog-PubSub-Secret with a value configured in the subscription.

Answer

Verify the message payload signature using the HMAC key associated with the Pub/Sub topic.

Question 13

A developer is writing unit tests for a Python application that will run on Cloud Functions. The function makes HTTP requests to an external API. The developer wants to avoid making actual network calls during tests. What should the developer use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Inject a mock Pub/Sub client into the function and assert that the publish method is called with the expected arguments.. For unit testing a Cloud Function that publishes to Pub/Sub, mocking the Pub/Sub client is the best practice. It allows the test to verify that the function calls the publish method with the correct parameters without actually sending messages to Pub/Sub. This keeps tests fast, isolated, and reliable, and avoids dependencies on external services or emulators.

Answer

Use the Pub/Sub emulator and set the PUBSUB_EMULATOR_HOST environment variable.

Answer

Use the Pub/Sub REST API with a service account key to publish a test message.

Answer

Deploy the function to a test project and trigger it with a test message, then check Pub/Sub logs.

Question 14

A developer is using Cloud Build to run unit tests for a Python application. The build step uses the python:3.9 image and runs pip install -r requirements.txt followed by pytest. The build fails with an error that some tests cannot find the required dependencies. The build logs show that pip install completed successfully. What is the most likely cause?

Accepted Answer

The pytest command is not using the same Python interpreter that pip installed packages into.. The most likely cause is that pip and pytest are using different Python interpreters. This can happen if the image has multiple Python installations or if the PATH is altered. When pip installs packages into one interpreter's site-packages, another interpreter cannot import them. Ensuring both commands invoke the same Python executable fixes the problem.

Answer

The Cloud Build step does not persist the installed dependencies between steps, but the tests are run in the same step.

Answer

The tests are run in a different working directory than where pip installed the dependencies.

Answer

The cloudbuild.yaml file does not specify a volume to mount the dependencies directory.

Question 15

A developer is building a Cloud Run service that reads from Cloud Storage. During local testing, the application uses the default application credentials and works. After deploying to Cloud Run, the service fails with a 403 error when accessing the bucket. The developer confirmed the Cloud Run service account has the Storage Object Viewer role. What is the most likely cause?

Accepted Answer

The Cloud Run service is not configured with the correct service account; it is using the default Compute Engine service account which lacks the role.. Cloud Run uses the service account specified in the revision configuration. If none is set, it defaults to the Compute Engine default service account. The developer granted permissions to a different service account, so the deployed service lacks access. Assigning the intended service account to the Cloud Run service resolves the permission error.

Answer

The application code is using the Cloud Storage XML API instead of the JSON API, which does not support IAM authentication.

Answer

The Cloud Run service needs the Storage Object Viewer role on the project, not on the bucket, because Cloud Run evaluates permissions at the project level.

Answer

The Cloud Storage bucket has uniform bucket-level access disabled, so IAM roles are not enforced for object reads.