PCD Building and testing applications Practice Test 2 — 15 Questions

Question 1

Which THREE steps are required to set up end-to-end testing for a Cloud Run service that uses Firestore and Pub/Sub?

Accepted Answer

Automate the teardown of test resources after test completion. End-to-end testing of a Cloud Run service that interacts with Firestore and Pub/Sub must include automated teardown of test resources (e.g., Pub/Sub topics, subscriptions, Firestore documents) to prevent resource leaks and avoid incurring ongoing costs. Without teardown, leftover resources can cause quota exhaustion and interfere with subsequent test runs, making automation essential for reliable CI/CD pipelines.

Answer

Use the Cloud Run emulator to run the service locally

Answer

Use the Firestore emulator to simulate Firestore operations

Question 2

Refer to the exhibit. A developer deployed a Cloud Run service as shown. Authenticated requests from another service in the same project using a service account receive 403 Forbidden. What is the most likely cause?

Accepted Answer

The service account used to authenticate is not granted the roles/run.invoker role on the Cloud Run service. The Cloud Run service requires the IAM role `roles/run.invoker` on the service itself for any principal (including a service account) to invoke it. Since the service was deployed with `--no-allow-unauthenticated`, only explicitly granted principals can invoke it. The service account used for authentication lacks this role, causing the 403 Forbidden response.

Answer

The Cloud Run service requires the 'allAuthenticatedUsers' member to be added

Answer

The --no-allow-unauthenticated flag blocks all requests including authenticated ones

Answer

The container image was built without proper authentication headers

Question 3

Refer to the exhibit. A developer is configuring Cloud Build to build a Docker image from a Cloud Source Repository. The build fails with a permission error. What is the most likely reason?

Accepted Answer

The service account is missing the roles/source.reader role to access the repository. The build fails with a permission error because the Cloud Build service account does not have the `roles/source.reader` role on the Cloud Source Repository. Without this role, the service account cannot read the source code from the repository, which is required to trigger the build. The error is not about building permissions but about accessing the source.

Answer

The service account lacks the roles/cloudbuild.builds.builder role

Answer

The Cloud Source Repository does not have the build trigger enabled

Answer

The build config file is missing the 'source' field

Question 4

A developer is building a CI/CD pipeline for a microservices application. The pipeline should build a container image, run unit tests, and deploy to Google Kubernetes Engine (GKE) only if all tests pass. Which Google Cloud service is best suited for orchestrating this pipeline?

Accepted Answer

Cloud Build. Cloud Build is the correct choice because it is a fully managed CI/CD platform that natively supports building container images, running unit tests, and deploying to GKE. It can be configured with a cloudbuild.yaml file to define steps for building, testing, and deploying, and it only proceeds to the deploy step if all prior steps (including tests) succeed. This makes it the best fit for orchestrating the entire pipeline in a single, integrated service.

Answer

Compute Engine

Answer

Cloud Run

Answer

Cloud Functions

Question 5

A team uses Cloud Source Repositories for version control and Cloud Build for CI. The build configuration file (cloudbuild.yaml) includes a step that runs unit tests. The team wants to ensure that the build fails if any test fails. What should the developer do?

Accepted Answer

Ensure the test command in the build step returns a non-zero exit code when tests fail.. Cloud Build executes each step as a container, and the build step's success or failure is determined by the exit code of the command run inside that container. If the test command (e.g., `npm test` or `pytest`) returns a non-zero exit code when tests fail, Cloud Build will automatically mark that step as failed and stop the build. No special configuration or custom builder is required beyond ensuring the test command itself propagates the failure exit code.

Answer

Use Cloud Build's built-in test runner that automatically fails the build on test failure.

Answer

Create a custom builder that runs tests and emits a non-zero exit code on failure.

Answer

Add a pre-build step that checks test results and triggers a build failure if needed.

Question 6

An application running on Compute Engine uses Cloud Storage for storing user-uploaded images. During load testing, the application experiences high latency when reading images. The developer suspects that the application is making too many small read requests. Which approach should the developer take to optimize performance?

Accepted Answer

Increase the read size to reduce the number of API requests.. The high latency is caused by many small read requests, each incurring API overhead. By increasing the read size (e.g., reading larger chunks or using range requests), the application reduces the number of API calls, which lowers cumulative latency and improves throughput. This directly addresses the root cause of excessive small reads.

Answer

Enable Cloud CDN to cache the images at edge locations.

Answer

Rewrite the objects to use a different storage class.

Answer

Mount the Cloud Storage bucket using Cloud Storage FUSE and read files from the local filesystem.

Question 7

A developer is deploying a new version of a microservice to Cloud Run. The developer wants to ensure that the new revision is tested with a small percentage of traffic before rolling out to all users. Which TWO approaches can the developer use?

Accepted Answer

Use the 'gcloud run deploy' command with '--no-traffic' and then use 'gcloud run services update-traffic --to-revisions=REVISION=5' to send 5% of traffic.. The '--no-traffic' flag deploys the new revision without serving any traffic, and then 'gcloud run services update-traffic --to-revisions=REVISION=5' allows you to send exactly 5% of traffic to that revision for canary testing. Option B is also correct because it describes the same two-step process: deploy with '--no-traffic' to avoid immediate traffic, then use 'update-traffic' to gradually increase the percentage, which is the standard canary deployment pattern on Cloud Run.

Answer

Set the 'max-instances' parameter to limit the number of instances handling requests.

Answer

Use the 'gcloud run deploy' command with '--tag' to assign a tag to the new revision, then direct test traffic to that tag.

Answer

Deploy the new revision with the same revision name as the old one to overwrite it, then roll back if issues occur.

Question 8

A developer runs the above command and cloudbuild.yaml. The build fails at the deploy step with a permission error. The developer has the Cloud Build Editor role on the project. What is the likely cause?

Accepted Answer

The Cloud Build service account lacks the Cloud Run Admin role.. The Cloud Build Editor role grants permissions to submit builds and execute build steps, but the actual execution of those steps (including the deploy step) runs under the Cloud Build service account. By default, this service account does not have the Cloud Run Admin role, which is required to deploy to Cloud Run. Without this role, the `gcloud run deploy` command fails with a permission error.

Answer

The Cloud Build Editor role does not have permission to submit builds.

Answer

The Docker image is not in a format compatible with Cloud Run.

Answer

The build step uses the 'gcloud' command without authentication.

Question 9

You are a developer for an e-commerce platform running on Google Kubernetes Engine (GKE) with a Cloud SQL backend. The application uses Cloud Memorystore for Redis for session caching. During a flash sale, you notice that the application latency spikes and some users are unable to complete checkout. You suspect the Redis instance is overwhelmed. The Redis instance is currently a Standard tier instance with 5 GB of memory. You need to increase throughput without significant architectural changes. You have the following options: A) Use client-side caching to reduce load on the Redis instance. B) Switch to a Memorystore Standard tier instance with a higher capacity and enable scaling. C) Migrate to a Memorystore Basic tier instance with a larger memory size. D) Enable for Redis clustering on the existing instance to distribute load across shards. Which option should you choose?

Accepted Answer

Switch to a Memorystore Standard tier instance with a higher capacity and enable scaling.. Enabling scaling on a Memorystore Standard tier instance allows you to increase the instance's capacity and throughput without architectural changes. Scaling up the memory size increases the available CPU and network bandwidth, directly addressing the latency spike during the flash sale. This approach maintains the existing Redis configuration and requires no application code changes, unlike clustering or client-side caching.

Answer

Use client-side caching to reduce load on the Redis instance.

Answer

Migrate to a Memorystore Basic tier instance with a larger memory size.

Answer

Enable for Redis clustering on the existing instance to distribute load across shards.

Question 10

Refer to the exhibit. A Cloud Build config deploys a new image to GKE. After the build succeeds, the pods restart with the new image but the application configuration is unchanged. What is the most likely cause?

Accepted Answer

The ConfigMap is not updated with the new configuration values.. A is correct because a Cloud Build config that deploys a new image to GKE does not automatically update the ConfigMap. The pods restart with the new image, but the application configuration remains unchanged because the ConfigMap still holds the old values. To apply new configuration, the ConfigMap must be updated separately, and the pods must be restarted or redeployed to pick up the changes.

Answer

The deployment rollout strategy is set to Recreate, causing downtime.

Answer

The new image is not being pulled because of imagePullPolicy: IfNotPresent.

Answer

The GKE cluster does not have sufficient permissions to pull from Container Registry.

Question 11

Which TWO actions should a developer take to ensure that a Cloud Run service can access a Cloud SQL instance securely?

Accepted Answer

Use the Cloud SQL Auth Proxy as a sidecar container in the same pod.. The Cloud SQL Auth Proxy, when deployed as a sidecar container in the same pod, provides encrypted connections and IAM-based authentication to Cloud SQL without requiring a public IP or complex network configuration. It automatically handles TLS 1.3 encryption and uses the service account's IAM permissions to authorize connections, ensuring secure access from Cloud Run.

Answer

Use a Cloud NAT to provide outbound internet access for the service.

Answer

Assign a public IP to the Cloud SQL instance and allow all traffic from Cloud Run.

Answer

Create a service account with the cloudsql.instances.connect permission.

Question 12

A team is developing a microservice that needs to store user profile images in Cloud Storage. The service is deployed on Cloud Run and will be invoked by other services via HTTP. The images are uploaded by users and the service must validate that the file is an image (e.g., JPEG, PNG) before storing it. The team wants to minimize costs and operational overhead while ensuring that only valid images are stored. The current implementation uploads the file directly to Cloud Storage from the client, but the team wants to add validation in the service. Which approach should the team take?

Accepted Answer

Have the client send the file to the Cloud Run service, validate the file on the server side, and then upload it to Cloud Storage using the Google Cloud Storage client library.. It keeps the validation logic within the Cloud Run service, which is already deployed and handling HTTP requests. The service can receive the file via HTTP, validate its MIME type and magic bytes on the server side, and then upload it to Cloud Storage using the Google Cloud Storage client library. This minimizes costs (no additional compute services) and operational overhead (single service to manage), while ensuring only valid images are stored.

Answer

Create a separate Cloud Function that receives the file, validates it, and uploads it to Cloud Storage. Invoke the Cloud Function from the client.

Answer

Validate the file on the client side before uploading directly to Cloud Storage, and rely on client-side validation.

Answer

Upload the file to Cloud Storage, then trigger a Cloud Function using Cloud Storage events to validate the file and delete it if invalid.

Question 13

Drag and drop the steps to set up a Cloud Build trigger for continuous deployment in the correct order.

Accepted Answer

1. Connect your repository (e.g., GitHub, Cloud Source Repositories). 2. Create a new trigger in Cloud Build. 3. Configure the trigger event (e.g., push to a specific branch). 4. Specify the build configuration file (e.g., cloudbuild.yaml).. A Cloud Build trigger is set up by connecting a repository and configuring the conditions for automatic builds.

Answer

1. Create a new trigger in Cloud Build. 2. Connect your repository. 3. Configure the trigger event. 4. Specify the build configuration file.

Answer

1. Configure the trigger event. 2. Connect your repository. 3. Create a new trigger in Cloud Build. 4. Specify the build configuration file.

Answer

1. Specify the build configuration file. 2. Connect your repository. 3. Create a new trigger in Cloud Build. 4. Configure the trigger event.

Question 14

Drag and drop the steps to configure a Cloud CDN with a Cloud Load Balancer in the correct order.

Accepted Answer

Create a Cloud Storage bucket, then create an external HTTP(S) load balancer with the bucket as a backend, then enable Cloud CDN on the backend bucket, then update DNS records to point to the load balancer's IP.. Cloud CDN is enabled on a backend bucket of a load balancer, then DNS is configured.

Answer

Create a Cloud Storage bucket, then enable Cloud CDN on the bucket, then create an external HTTP(S) load balancer with the bucket as a backend, then update DNS records.

Answer

Create an external HTTP(S) load balancer, then create a Cloud Storage bucket, then enable Cloud CDN on the bucket, then update DNS records.

Answer

Enable Cloud CDN on a bucket, then create an external HTTP(S) load balancer, then add the bucket as a backend, then update DNS records.

Question 15

Match each Cloud Storage class to its typical use case.

Accepted Answer

Standard: Frequently accessed data. Cloud Storage classes optimize cost based on access frequency. Standard is for hot data, Nearline for monthly, Coldline for quarterly, and Archive for yearly access. Common mistakes involve confusing the frequency thresholds.

Answer

Standard: Data accessed less than once a year

Answer

Nearline: Data accessed less than once a quarter