PCD Building and testing applications Practice Test 3 — 15 Questions

Question 1

A developer is setting up a Cloud Build configuration file for a Node.js application. They want to ensure that build steps are executed only when changes are pushed to the 'main' branch. What is the correct approach?

Accepted Answer

Use a build trigger with a branch filter. Option D is correct because Cloud Build triggers can be configured with a branch filter (e.g., `^main$`) that ensures builds are only initiated when changes are pushed to the specified branch. This is the native, declarative way to control build execution based on Git branch events, without requiring custom scripting or external scheduling.

Answer

Use a script in the build step to check the branch name

Answer

Use Cloud Scheduler to trigger builds based on time intervals

Answer

Use a condition in the build config file

Question 2

A team is deploying a containerized application to Cloud Run. The application needs to process large files (up to 500 MB) uploaded by users. Which storage approach should they use to avoid Cloud Run's request size limit?

Accepted Answer

Use signed URLs to upload to Cloud Storage. Cloud Run has a default request size limit of 32 MB, which is far below the 500 MB files the application needs to process. Using signed URLs allows users to upload files directly to Cloud Storage, bypassing Cloud Run entirely. This approach avoids the request size limit and offloads the storage and retrieval of large files to a scalable, managed service.

Answer

Upload files directly to Cloud Run

Answer

Mount a Cloud Filestore volume

Answer

Use Cloud Functions as a proxy for uploads

Question 3

A development team uses Cloud Build for CI/CD with a monorepo containing multiple microservices. They want to implement a strategy where only the services affected by a commit are built and deployed. Which approach best achieves this?

Accepted Answer

Use multiple Cloud Build triggers, one per service, each with a path filter for its directory. Option D is correct because Cloud Build triggers support path filters that allow you to specify which directories or files should initiate a build. By creating one trigger per microservice directory, only the service whose code has changed will be built and deployed, which is the most efficient and native approach for a monorepo with multiple services.

Answer

Use a single Cloud Build trigger with a condition to check changed files

Answer

Use Cloud Functions to detect changes and trigger builds

Answer

Use a single Cloud Build trigger with a bash script to detect changes

Question 4

A developer is writing a Cloud Function that throws an exception when processing invalid input. They want to ensure the function returns an appropriate HTTP error response. What should they do?

Accepted Answer

Return a response with a status code and error message from the function. Option B is correct because in Cloud Functions (and serverless platforms like Google Cloud Functions), the function code itself is responsible for constructing and returning an HTTP response, including setting the appropriate status code and error message. Throwing an exception alone does not automatically map to an HTTP error response; the platform will typically return a generic 500 error, which is not appropriate for invalid input (e.g., 400 Bad Request). By explicitly returning a response object with a status code (e.g., 400) and a descriptive error message, the developer ensures the client receives a meaningful and correct HTTP error response.

Answer

Log the error and return a success response

Answer

Use a global error handler in the function framework

Answer

Throw an exception and let the platform handle it automatically

Question 5

A team deploys a stateful application on GKE using StatefulSets. They need to test data persistence after pod rescheduling. Which test scenario best validates this?

Accepted Answer

Delete a pod and verify the new pod has the same data from PersistentVolumeClaim. Option B is correct because deleting a pod in a StatefulSet triggers Kubernetes to reschedule a new pod with the same identity and PersistentVolumeClaim (PVC). The PVC retains the data from the original pod, so verifying that the new pod has the same data directly confirms that the PersistentVolume (PV) is correctly bound and the data persists across pod rescheduling. This tests the core persistence guarantee of StatefulSets without altering the replica count or cluster state.

Answer

Use a CronJob to regularly snapshot the data

Answer

Scale down the StatefulSet to 0 and scale up again, then check data

Answer

Delete the entire cluster and recreate it from backups

Question 6

A company uses Cloud Build to build Docker images and push them to Artifact Registry. They want to ensure that only images built from a specific Cloud Build trigger are deployed to production. Which combination of steps should they implement?

Accepted Answer

Configure Binary Authorization with a policy requiring attestation from Cloud Build. Binary Authorization allows attestations that enforce only images built by a specific process (e.g., via Cloud Build) can be deployed. Other options do not tie the deployment to the build source.

Answer

Configure IAM roles to restrict push access to Artifact Registry

Answer

Use Cloud Deploy with a manual approval gate

Answer

Use Cloud Build's built-in approval mechanism

Question 7

A developer is writing unit tests for a Cloud Function that reads from Firestore. They want to avoid real Firestore calls in tests. Which approach is best?

Accepted Answer

Mock the Firestore client library in the test code. Mocking the Firestore client library allows testing the function logic without dependencies on external services, which is the essence of unit testing.

Answer

Use Cloud Functions local emulator with Firestore emulator

Answer

Create a test project with real Firestore and use real calls

Answer

Use Firestore emulator for tests

Question 8

A Cloud Run service experiences high latency under load. The service is a Node.js Express app that processes requests sequentially due to a global mutex. What is the most effective solution?

Accepted Answer

Remove the mutex and ensure request handling is asynchronous. The root cause is that the global mutex forces sequential processing, negating Node.js's asynchronous event loop. Removing the mutex and ensuring asynchronous request handling (e.g., using async/await or Promises) allows the single-threaded event loop to interleave I/O-bound tasks, dramatically reducing latency under concurrent load. This directly addresses the bottleneck without changing the underlying infrastructure.

Answer

Use Cloud Run for Anthos to handle load

Answer

Increase the number of CPUs per container

Answer

Increase the 'max-instances' setting

Question 9

A team uses Cloud Build to deploy applications that need to access a Cloud SQL database in a VPC. They want to avoid exposing the database to the public internet. Which configuration is required?

Accepted Answer

Configure Cloud Build to use a private pool in the same VPC as the database. Cloud Build private pools run in a customer-managed VPC, allowing workers to directly access resources like Cloud SQL instances via private IP without traversing the public internet. This configuration ensures the database is never exposed to the public internet, meeting the security requirement.

Answer

Enable VPC Network Peering between Cloud Build and the database VPC

Answer

Use Cloud SQL Proxy in a Cloud Build step

Answer

Use a public IP on Cloud SQL and restrict by IP whitelist

Question 10

A team uses GitHub for source control. They want to automatically trigger Cloud Build builds on pull request creation. Which two actions are required? (Choose two.)

Accepted Answer

Install the Cloud Build GitHub app in the repository. Installing the Cloud Build GitHub app and creating a trigger with the 'pull_request' event are the two necessary steps. Other options are either not needed or incorrect.

Answer

Configure a webhook in GitHub to send push events to Cloud Build

Answer

Use Cloud Source Repositories as a mirror of GitHub

Answer

In the Cloud Build trigger, set the event to 'push' and branch filter to 'pull-request/*'

Question 11

A developer wants to ensure their Cloud Function is reliable. Which three testing practices should they follow? (Choose three.)

Accepted Answer

Write unit tests that mock external services. Option A is correct because unit tests should mock external services (like databases or APIs) to isolate the function's logic and avoid dependencies on live infrastructure. This ensures tests are fast, deterministic, and do not incur costs or side effects from actual service calls.

Answer

Deploy the function to production for integration testing

Answer

Perform load testing using a Cloud Scheduler job that invokes the function frequently

Question 12

A company wants to deploy a containerized application to Cloud Run. Which two approaches are supported? (Choose two.)

Accepted Answer

Use gcloud beta run deploy with --source flag to build and deploy from source. Cloud Run supports source-based deployment with the `--source` flag and building/pushing to Artifact Registry then deploying. Other options are not valid deployment methods.

Answer

Use Cloud Functions to package the container as a function

Answer

Upload a Dockerfile to Cloud Run console and let it build

Answer

Use Kubernetes Engine to deploy the container and then migrate to Cloud Run

Question 13

A developer uses the above cloudbuild.yaml. The build fails with error: 'unauthorized: You don't have the permission to push to this repository.' What is the most likely cause?

Accepted Answer

The Cloud Build service account does not have Artifact Registry Writer role. The error 'unauthorized: You don't have the permission to push to this repository' indicates that the Cloud Build service account lacks the necessary IAM permissions to push the container image to Artifact Registry. By default, Cloud Build uses the default compute engine service account (PROJECT_NUMBER-compute@developer.gserviceaccount.com) or a user-specified service account, which must have the Artifact Registry Writer role (roles/artifactregistry.writer) to push images. Without this role, the push is denied regardless of the image tag, registry URL, or project ID spelling.

Answer

The image tag 'latest' is invalid

Answer

The Docker registry URL is incorrect

Answer

The project ID 'my-project' is misspelled

Question 14

A developer created a Cloud Function that makes an HTTP request to an external API. The above error occurs intermittently. The external API is working correctly. What is the most likely cause?

Accepted Answer

The request to the external API has incorrect headers or payload. The 'INVALID_ARGUMENT' error indicates the request payload or headers are malformed. Intermittent occurrence suggests a data-dependent issue rather than a permanent config problem.

Answer

The function is not handling network retries properly

Answer

The Cloud Function is not deployed in the same region as the API

Answer

The function is timing out due to long response time

Question 15

A developer runs the above command and receives a successful deployment. However, the service is not accessible from the internet. The service is intended to be public. What should the developer check next?

Accepted Answer

The service IAM policy to ensure allUsers has Cloud Run Invoker role. Option D is correct because Cloud Run services are private by default; even after a successful deployment, the service will not be accessible from the internet unless the IAM policy explicitly grants the `roles/run.invoker` role to `allUsers`. Without this permission, any HTTP request from outside the project will be denied with a 403 Forbidden error, regardless of the service's health or region.

Answer

The region us-central1 is not available

Answer

The Cloud Run service has a custom domain mapped

Answer

The container image is healthy