PCD Building and testing applications Practice Test 5 — 15 Questions

Question 1

A development team wants to implement a CI/CD pipeline for a containerized application on Google Cloud. They are using Cloud Build and Cloud Deploy. The application requires canary deployments with automatic rollback if the error rate increases by more than 10% within 5 minutes after deployment. Which Cloud Deploy feature should they configure?

Accepted Answer

Define a Cloud Deploy deployment policy with a rollout policy that uses a canary strategy and a verification phase with automated rollback. Option A is correct because Cloud Deploy's deployment policies allow you to define a canary rollout strategy with an automated verification phase. When the verification phase detects that the error rate exceeds the defined threshold (e.g., 10% increase within 5 minutes), Cloud Deploy automatically initiates a rollback to the previous stable revision, meeting the team's requirement without additional custom code.

Answer

Configure a Pub/Sub notification on the rollout to trigger a rollback via a Cloud Function

Answer

Use Cloud Monitoring to create an alert policy that triggers a Cloud Function to rollback the deployment

Answer

Set up a Cloud Build trigger to rebuild the previous image on error

Question 2

Your organization uses Cloud Functions (1st gen) to process events from Cloud Storage. Recently, you migrated to Cloud Functions (2nd gen) to take advantage of longer timeouts and concurrency. After the migration, some invocations fail with 'DeadlineExceeded' errors even though the total execution time is below the 60-minute limit. What is the most likely cause?

Accepted Answer

The function is processing multiple concurrent requests per instance, causing a single request to exceed the HTTP timeout due to contention. Option B is correct because Cloud Functions (2nd gen) supports concurrent request processing per instance. When multiple requests are handled simultaneously by the same instance, they share the instance's resources, including the HTTP timeout. If one request consumes excessive time due to contention (e.g., waiting for CPU or I/O), other concurrent requests may hit the HTTP request timeout (default 60 minutes for 2nd gen) even if their individual execution time is shorter. This is a common issue when migrating from 1st gen (which processes one request at a time) to 2nd gen with concurrency enabled.

Answer

The function does not have enough memory allocated for the new workload

Answer

The function is being cold-started more frequently due to reduced min instances

Answer

The function timeout is still set to the 1st gen default of 9 minutes

Question 3

A team is developing a REST API on Cloud Run. They need to ensure that only authenticated requests from their corporate domain (example.com) are allowed. Which configuration should they use?

Accepted Answer

Set the Cloud Run service to require authentication and allow only the domain 'example.com' in the IAM policy. Option A is correct because Cloud Run's IAM integration allows you to require authentication (via the `--no-allow-unauthenticated` flag) and then use IAM conditions to restrict access to principals from a specific domain (e.g., `request.auth.claims.email` ends with `@example.com`). This ensures only authenticated requests from the corporate domain are permitted, leveraging Google Cloud's identity-aware proxy (IAP) capabilities without additional infrastructure.

Answer

Implement custom authentication using Firestore to validate user tokens

Answer

Use Cloud Endpoints with an API key that is shared only with corporate users

Answer

Use Cloud Armor to deny traffic except from the corporate IP range

Question 4

Your team is building a Node.js application for Google App Engine Standard Environment. The application uses a custom runtime and must run background tasks. However, you notice that background tasks are being terminated after a few seconds. What is the most likely reason?

Accepted Answer

App Engine Standard Environment does not support background threads; use App Engine Flexible or Cloud Run instead. In Google App Engine Standard Environment, background threads are not supported because the runtime can terminate idle instances or scale down to zero, killing any background tasks. The correct solution is to use App Engine Flexible Environment or Cloud Run, which support long-running background processes, or to offload tasks to a service like Cloud Tasks or Cloud Pub/Sub. Option D correctly identifies this fundamental limitation of the Standard Environment.

Answer

The application should use Cloud Tasks instead of background threads

Answer

The application is not configured with max_concurrent_requests set to 1

Answer

You are using an automatic scaling instance class that does not support background threads

Question 5

You are building a data pipeline using Cloud Dataflow (Apache Beam). The pipeline reads from Pub/Sub, performs aggregations, and writes to BigQuery. Occasionally, you see duplicates in the BigQuery output, even though the pipeline uses .withInsertId() in the BigQuery write transform. What could be causing these duplicates?

Accepted Answer

The pipeline is using at-least-once mode and bundles are being retried, but the insertId is not being reused across retry attempts. Option C is correct because Cloud Dataflow (Apache Beam) operates in at-least-once mode by default, meaning bundles may be retried during processing. When a bundle is retried, the insertId set via .withInsertId() must be reused across retry attempts to enable BigQuery's deduplication. If the insertId is not reused (e.g., because it's generated per attempt or not properly propagated), BigQuery treats each write as a separate row, resulting in duplicates.

Answer

You are not using the exactly-once sink option for BigQuery

Answer

You have set .withOutputParallelization() to false

Answer

You need to enable Dataflow's built-in deduplication using the .withIdAttribute() in Pub/Sub read

Question 6

A developer wants to store secrets (e.g., API keys) for use in Cloud Functions without exposing them in the source code. Which Google Cloud service should they use?

Accepted Answer

Use Secret Manager to store secrets and reference them via secret environment variables. Secret Manager is the dedicated Google Cloud service for storing sensitive data like API keys, passwords, and certificates. It provides built-in versioning, access control via IAM, and native integration with Cloud Functions through secret environment variables, ensuring secrets are never exposed in source code or configuration files.

Answer

Store secrets in a Cloud Storage bucket with encrypted objects and load them at runtime

Answer

Use Firestore to store secrets in a secure document and access it via the Firestore SDK

Answer

Use Cloud Key Management Service (Cloud KMS) to create and manage secrets

Question 7

You are designing a CI/CD pipeline for a microservices application deployed on GKE. Your team requires that each service have independent release cycles and canary deployments. Which combination of Google Cloud services should you use?

Accepted Answer

Cloud Source Repositories, Cloud Build, and Cloud Deploy with GKE target. Option C is correct because Cloud Deploy provides native support for canary deployments and progressive delivery strategies to GKE targets, enabling independent release cycles per microservice. Cloud Source Repositories hosts the code, Cloud Build compiles and tests it, and Cloud Deploy manages the rollout with Skaffold-based pipelines, allowing fine-grained traffic splitting and automated promotion or rollback.

Answer

Cloud Source Repositories, Cloud Build, and App Engine

Answer

Cloud Source Repositories, Cloud Build, and Cloud Run

Answer

Cloud Source Repositories, Cloud Build, and Spinnaker

Question 8

Your team is using Cloud Build to build and test a Java application. The build includes unit tests, integration tests, and static code analysis. The build is failing intermittently due to flaky tests. You want to automatically retry the failed steps without rebuilding everything. Which Cloud Build feature should you use?

Accepted Answer

Set the 'allowFailure: false' and 'retry: 2' options on the test steps in the cloudbuild.yaml. Option B is correct because Cloud Build supports the `retry` option on individual build steps, which allows a step to be automatically retried a specified number of times upon failure without re-executing previous steps. This is ideal for handling flaky tests, as it only reruns the failed step, preserving build artifacts and avoiding a full rebuild.

Answer

Configure a Cloud Build trigger to rerun the build on failure

Answer

Use build substitutions to pass different test parameters on failure

Answer

Increase the timeout for the build to allow retries

Question 9

A team wants to implement automated testing for a Python application deployed on Cloud Run. They want the tests to run as part of the CI/CD pipeline after the image is built but before it is deployed. Which approach should they use?

Accepted Answer

Add a test step in Cloud Build that uses the built image to run integration tests before deploying. Option C is correct because Cloud Build allows you to add a test step that runs the built container image before deploying it to Cloud Run. This ensures integration tests validate the application in an environment identical to production, catching issues early in the CI/CD pipeline. Running tests after the image is built but before deployment is a standard practice for shift-left testing.

Answer

Use Cloud Function to run tests triggered by a Pub/Sub message after the image is published

Answer

Run unit tests before building the image using Cloud Build, but skip integration tests

Answer

Deploy the image to a staging environment, run tests, and then promote to production

Question 10

Which TWO statements are true about Cloud Functions? (Choose two.)

Accepted Answer

Cloud Functions automatically scale based on the number of incoming events. Cloud Functions automatically scale horizontally based on the number of incoming events, such as HTTP requests or Pub/Sub messages. The platform handles this scaling transparently, spinning up new function instances as needed to handle concurrent invocations, and scaling down to zero when idle. This is a key serverless characteristic that eliminates the need for manual capacity planning.

Answer

Cloud Functions require you to provide a container image from Container Registry

Answer

Cloud Functions can only be triggered by HTTP requests

Answer

Cloud Functions have a maximum execution timeout of 9 minutes for all runtimes

Question 11

Which THREE are best practices for building applications on GKE? (Choose three.)

Accepted Answer

Set resource requests and limits for CPU and memory. Setting resource requests and limits for CPU and memory is a best practice because it allows Kubernetes to make informed scheduling decisions and ensures that pods do not exceed their allocated resources, preventing resource starvation for other workloads. Requests guarantee a minimum amount of resources for the pod, while limits cap the maximum, enabling the cluster autoscaler and scheduler to optimize node utilization and maintain stability.

Answer

Use nodeSelector to pin pods to specific node instances for performance consistency

Answer

Use StatefulSets for all applications to preserve state across restarts

Question 12

Which TWO are benefits of using Cloud Build? (Choose two.)

Accepted Answer

It allows using custom build steps with community or private images. Option A is correct because Cloud Build allows you to use custom build steps with community or private container images, enabling you to run arbitrary tools and scripts as part of your build pipeline. This flexibility means you are not limited to Google-provided build steps and can integrate any software that runs in a container.

Answer

It only supports Java and Go runtimes

Answer

It requires a trigger to start any build

Answer

It provides a source code repository for version control

Question 13

Refer to the exhibit. You have the above cloudbuild.yaml file. The build succeeds but the call to the function fails with a permission error. What is the most likely cause?

Accepted Answer

The function call is occurring before the deployment is fully complete, and the function is not yet ready to serve requests. The most likely cause is that the Cloud Build step deploys the function, but the subsequent test call occurs before the function's HTTP endpoint is fully provisioned and serving requests. Cloud Functions deployment is asynchronous; after the `gcloud functions deploy` command returns, the function may still be in a 'DEPLOYING' or 'ACTIVE' state but not yet ready to handle traffic. A permission error in this context typically arises because the function's IAM policy (e.g., `--allow-unauthenticated`) is applied only after the deployment completes, and the function's runtime endpoint may return a 403 until fully ready.

Answer

The function is using the wrong trigger type

Answer

The runtime 'nodejs16' is not supported

Answer

The '--allow-unauthenticated' flag is not allowed in Cloud Build

Question 14

Refer to the exhibit. A developer deployed a Cloud Run service with the above command. They notice that the service's latency is higher than expected under load. The service performs CPU-intensive tasks. What is the most likely reason for the high latency?

Accepted Answer

The execution environment is gen2, which only allocates CPU during request processing by default; the high concurrency causes CPU contention. Cloud Run (gen2) allocates CPU based on request processing. With concurrency 80, and CPU-intensive tasks, the CPU may be throttled between requests. Option A is correct: gen2 only allocates CPU during request processing if not using CPU always on. Option B is incorrect because gen2 supports CPU-intensive tasks. Option C is incorrect because 4Gi memory should be sufficient. Option D is incorrect because scaling to 10 instances could help but doesn't address concurrency issue.

Answer

The service is using gen2, which does not support CPU-intensive workloads

Answer

The service should be deployed with --max-instances set to a lower number

Answer

The memory is insufficient for the concurrency level

Question 15

Refer to the exhibit. You run the above command to build and push a Docker image to Container Registry. The build fails with an error: 'denied: Unauthenticated access'. What should you do to resolve this?

Accepted Answer

Grant the Cloud Build service account the Storage Object Admin role on the project. The error 'denied: Unauthenticated access' indicates that the Cloud Build service account does not have permission to push images to Container Registry. By default, Cloud Build uses the Cloud Build service account (service-[PROJECT_NUMBER]@cloudbuild.gserviceaccount.com) to execute builds. Granting the Storage Object Admin role (roles/storage.admin) to this service account provides the necessary permissions to write objects (Docker image layers) to the Container Registry bucket in Cloud Storage, resolving the authentication failure.

Answer

Grant the Cloud Build service account the Project Editor role

Answer

Grant the Compute Engine default service account the Storage Object Creator role

Answer

Run gcloud auth login as the project owner before submitting the build