PCD Building and testing applications Practice Test 2 — 15 Questions

Question 1

Refer to the exhibit. A developer is configuring Cloud Build to build a Docker image from a Cloud Source Repository. The build fails with a permission error. What is the most likely reason?

Accepted Answer

The service account is missing the roles/source.reader role to access the repository. The build fails with a permission error because the Cloud Build service account does not have the `roles/source.reader` role on the Cloud Source Repository. Without this role, the service account cannot read the source code from the repository, which is required to trigger the build. The error is not about building permissions but about accessing the source.

Answer

The service account lacks the roles/cloudbuild.builds.builder role

Answer

The Cloud Source Repository does not have the build trigger enabled

Answer

The build config file is missing the 'source' field

Question 2

A developer is building a CI/CD pipeline for a microservices application. The pipeline should build a container image, run unit tests, and deploy to Google Kubernetes Engine (GKE) only if all tests pass. Which Google Cloud service is best suited for orchestrating this pipeline?

Accepted Answer

Cloud Build. Cloud Build is the correct choice because it is a fully managed CI/CD platform that natively supports building container images, running unit tests, and deploying to GKE. It can be configured with a cloudbuild.yaml file to define steps for building, testing, and deploying, and it only proceeds to the deploy step if all prior steps (including tests) succeed. This makes it the best fit for orchestrating the entire pipeline in a single, integrated service.

Answer

Compute Engine

Answer

Cloud Run

Answer

Cloud Functions

Question 3

A team uses Cloud Source Repositories for version control and Cloud Build for CI. The build configuration file (cloudbuild.yaml) includes a step that runs unit tests. The team wants to ensure that the build fails if any test fails. What should the developer do?

Accepted Answer

Ensure the test command in the build step returns a non-zero exit code when tests fail.. Option B is correct because Cloud Build executes each step as a container, and the build step's success or failure is determined by the exit code of the command run inside that container. If the test command (e.g., `npm test` or `pytest`) returns a non-zero exit code when tests fail, Cloud Build will automatically mark that step as failed and stop the build. No special configuration or custom builder is required beyond ensuring the test command itself propagates the failure exit code.

Answer

Use Cloud Build's built-in test runner that automatically fails the build on test failure.

Answer

Create a custom builder that runs tests and emits a non-zero exit code on failure.

Answer

Add a pre-build step that checks test results and triggers a build failure if needed.

Question 4

An application running on Compute Engine uses Cloud Storage for storing user-uploaded images. During load testing, the application experiences high latency when reading images. The developer suspects that the application is making too many small read requests. Which approach should the developer take to optimize performance?

Accepted Answer

Increase the read size to reduce the number of API requests.. Option C is correct because the high latency is caused by many small read requests, each incurring API overhead. By increasing the read size (e.g., reading larger chunks or using range requests), the application reduces the number of API calls, which lowers cumulative latency and improves throughput. This directly addresses the root cause of excessive small reads.

Answer

Enable Cloud CDN to cache the images at edge locations.

Answer

Rewrite the objects to use a different storage class.

Answer

Mount the Cloud Storage bucket using Cloud Storage FUSE and read files from the local filesystem.

Question 5

A developer is deploying a new version of a microservice to Cloud Run. The developer wants to ensure that the new revision is tested with a small percentage of traffic before rolling out to all users. Which TWO approaches can the developer use?

Accepted Answer

Use the 'gcloud run deploy' command with '--no-traffic' and then use 'gcloud run services update-traffic --to-revisions=REVISION=5' to send 5% of traffic.. Option A is correct because the '--no-traffic' flag deploys the new revision without serving any traffic, and then 'gcloud run services update-traffic --to-revisions=REVISION=5' allows you to send exactly 5% of traffic to that revision for canary testing. Option B is also correct because it describes the same two-step process: deploy with '--no-traffic' to avoid immediate traffic, then use 'update-traffic' to gradually increase the percentage, which is the standard canary deployment pattern on Cloud Run.

Answer

Set the 'max-instances' parameter to limit the number of instances handling requests.

Answer

Use the 'gcloud run deploy' command with '--tag' to assign a tag to the new revision, then direct test traffic to that tag.

Answer

Deploy the new revision with the same revision name as the old one to overwrite it, then roll back if issues occur.

Question 6

A developer runs the above command and cloudbuild.yaml. The build fails at the deploy step with a permission error. The developer has the Cloud Build Editor role on the project. What is the likely cause?

Accepted Answer

The Cloud Build service account lacks the Cloud Run Admin role.. The Cloud Build Editor role grants permissions to submit builds and execute build steps, but the actual execution of those steps (including the deploy step) runs under the Cloud Build service account. By default, this service account does not have the Cloud Run Admin role, which is required to deploy to Cloud Run. Without this role, the `gcloud run deploy` command fails with a permission error.

Answer

The Cloud Build Editor role does not have permission to submit builds.

Answer

The Docker image is not in a format compatible with Cloud Run.

Answer

The build step uses the 'gcloud' command without authentication.

Question 7

You are a developer for an e-commerce platform running on Google Kubernetes Engine (GKE) with a Cloud SQL backend. The application uses Cloud Memorystore for Redis for session caching. During a flash sale, you notice that the application latency spikes and some users are unable to complete checkout. You suspect the Redis instance is overwhelmed. The Redis instance is currently a Standard tier instance with 5 GB of memory. You need to increase throughput without significant architectural changes. You have the following options: A) Migrate to a Memorystore Basic tier instance with a larger memory size. B) Enable for Redis clustering on the existing instance to distribute load across shards. C) Switch to a Memorystore Standard tier instance with a higher capacity and enable scaling. D) Use client-side caching to reduce load on the Redis instance. Which option should you choose?

Accepted Answer

Switch to a Memorystore Standard tier instance with a higher capacity and enable scaling.. Option B is correct because enabling scaling on a Memorystore Standard tier instance allows you to increase the instance's capacity and throughput without architectural changes. Scaling up the memory size increases the available CPU and network bandwidth, directly addressing the latency spike during the flash sale. This approach maintains the existing Redis configuration and requires no application code changes, unlike clustering or client-side caching.

Answer

Use client-side caching to reduce load on the Redis instance.

Answer

Migrate to a Memorystore Basic tier instance with a larger memory size.

Answer

Enable for Redis clustering on the existing instance to distribute load across shards.

Question 8

Your team has developed a containerized application that processes streaming data from Pub/Sub. The application is deployed on Cloud Run. Under normal load, it processes messages within seconds. However, during spikes, processing time increases and some messages are not acknowledged before the Cloud Run request timeout of 60 minutes. You need to ensure that all messages are processed reliably without losing data. You have the following options: A) Increase the Cloud Run request timeout to 120 minutes. B) Use Cloud Run jobs instead of services to handle the processing asynchronously. C) Set up a second subscription to Pub/Sub with a different push endpoint to parallelize processing. D) Use a Cloud Tasks queue to decouple the Pub/Sub push and process messages with retries. Which option should you choose?

Accepted Answer

Use Cloud Run jobs instead of services to handle the processing asynchronously.. Option C is correct because Cloud Run jobs are designed for asynchronous, batch-style processing that can run longer than the 60-minute request timeout of Cloud Run services. By using a job, you can pull messages from Pub/Sub, process them without a hard timeout, and acknowledge them only after successful processing, ensuring reliable message handling during spikes.

Answer

Use a Cloud Tasks queue to decouple the Pub/Sub push and process messages with retries.

Answer

Increase the Cloud Run request timeout to 120 minutes.

Answer

Set up a second subscription to Pub/Sub with a different push endpoint to parallelize processing.

Question 9

Refer to the exhibit. A Cloud Build config deploys a new image to GKE. After the build succeeds, the pods restart with the new image but the application configuration is unchanged. What is the most likely cause?

Accepted Answer

The ConfigMap is not updated with the new configuration values.. A is correct because a Cloud Build config that deploys a new image to GKE does not automatically update the ConfigMap. The pods restart with the new image, but the application configuration remains unchanged because the ConfigMap still holds the old values. To apply new configuration, the ConfigMap must be updated separately, and the pods must be restarted or redeployed to pick up the changes.

Answer

The deployment rollout strategy is set to Recreate, causing downtime.

Answer

The new image is not being pulled because of imagePullPolicy: IfNotPresent.

Answer

The GKE cluster does not have sufficient permissions to pull from Container Registry.

Question 10

Which TWO actions should a developer take to ensure that a Cloud Run service can access a Cloud SQL instance securely?

Accepted Answer

Use the Cloud SQL Auth Proxy as a sidecar container in the same pod.. Option C is correct because the Cloud SQL Auth Proxy, when deployed as a sidecar container in the same pod, provides encrypted connections and IAM-based authentication to Cloud SQL without requiring a public IP or complex network configuration. It automatically handles TLS 1.3 encryption and uses the service account's IAM permissions to authorize connections, ensuring secure access from Cloud Run.

Answer

Use a Cloud NAT to provide outbound internet access for the service.

Answer

Assign a public IP to the Cloud SQL instance and allow all traffic from Cloud Run.

Answer

Create a service account with the cloudsql.instances.connect permission.

Question 11

A team is developing a microservice that needs to store user profile images in Cloud Storage. The service is deployed on Cloud Run and will be invoked by other services via HTTP. The images are uploaded by users and the service must validate that the file is an image (e.g., JPEG, PNG) before storing it. The team wants to minimize costs and operational overhead while ensuring that only valid images are stored. The current implementation uploads the file directly to Cloud Storage from the client, but the team wants to add validation in the service. Which approach should the team take?

Accepted Answer

Have the client send the file to the Cloud Run service, validate the file on the server side, and then upload it to Cloud Storage using the Google Cloud Storage client library.. Option B is correct because it keeps the validation logic within the Cloud Run service, which is already deployed and handling HTTP requests. The service can receive the file via HTTP, validate its MIME type and magic bytes on the server side, and then upload it to Cloud Storage using the Google Cloud Storage client library. This minimizes costs (no additional compute services) and operational overhead (single service to manage), while ensuring only valid images are stored.

Answer

Create a separate Cloud Function that receives the file, validates it, and uploads it to Cloud Storage. Invoke the Cloud Function from the client.

Answer

Validate the file on the client side before uploading directly to Cloud Storage, and rely on client-side validation.

Answer

Upload the file to Cloud Storage, then trigger a Cloud Function using Cloud Storage events to validate the file and delete it if invalid.

Question 12

Drag and drop the steps to set up a Cloud Build trigger for continuous deployment in the correct order.

Question 13

Drag and drop the steps to configure a Cloud CDN with a Cloud Load Balancer in the correct order.

Question 14

Match each Cloud Storage class to its typical use case.

Question 15

Match each command-line tool to its primary use.

PCD Building and testing applications Practice Test 2 — 15 Questions

Exhibit

PCD Building and testing applications Practice Test 2 — 15 Questions

Exhibit