PCD Building and testing applications Practice Test 5 — 15 Questions

Question 1

Refer to the exhibit. A developer writes the above Dockerfile for a Cloud Run service. The service fails to start. The logs indicate that the container exited immediately. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The server.js file is missing from the build context. The most likely cause is that the server.js file is missing from the build context. When the Dockerfile contains a COPY command (e.g., COPY . .) to copy application files, the server.js file must exist in the source directory from which the build is run. If it is absent, the container will have no entry point, and the CMD instruction (e.g., CMD ["node", "server.js"]) will fail because the file does not exist inside the image, causing the container to exit immediately. Cloud Run requires the container to start a listening process; without server.js, no process runs.

Answer

The WORKDIR is set to a directory that doesn't exist

Answer

The CMD instruction is incorrectly formatted

Answer

The EXPOSE 8080 instruction is unnecessary and may cause conflicts

Question 2

A development team wants to implement a CI/CD pipeline for a containerized application on Google Cloud. They are using Cloud Build and Cloud Deploy. The application requires canary deployments with automatic rollback if the error rate increases by more than 10% within 5 minutes after deployment. Which Cloud Deploy feature should they configure?

Accepted Answer

Define a Cloud Deploy deployment policy with a rollout policy that uses a canary strategy and a verification phase with automated rollback. Cloud Deploy's deployment policies allow you to define a canary rollout strategy with an automated verification phase. When the verification phase detects that the error rate exceeds the defined threshold (e.g., 10% increase within 5 minutes), Cloud Deploy automatically initiates a rollback to the previous stable revision, meeting the team's requirement without additional custom code.

Answer

Configure a Pub/Sub notification on the rollout to trigger a rollback via a Cloud Function

Answer

Use Cloud Monitoring to create an alert policy that triggers a Cloud Function to rollback the deployment

Answer

Set up a Cloud Build trigger to rebuild the previous image on error

Question 3

Your organization uses Cloud Functions (1st gen) to process events from Cloud Storage. Recently, you migrated to Cloud Functions (2nd gen) to take advantage of longer timeouts and concurrency. After the migration, some invocations fail with 'DeadlineExceeded' errors even though the total execution time is below the 60-minute limit. What is the most likely cause?

Accepted Answer

The function is processing multiple concurrent requests per instance, causing a single request to exceed the HTTP timeout due to contention. Cloud Functions (2nd gen) supports concurrent request processing per instance. When multiple requests are handled simultaneously by the same instance, they share the instance's resources, including the HTTP timeout. If one request consumes excessive time due to contention (e.g., waiting for CPU or I/O), other concurrent requests may hit the HTTP request timeout (default 60 minutes for 2nd gen) even if their individual execution time is shorter. This is a common issue when migrating from 1st gen (which processes one request at a time) to 2nd gen with concurrency enabled.

Answer

The function does not have enough memory allocated for the new workload

Answer

The function is being cold-started more frequently due to reduced min instances

Answer

The function timeout is still set to the 1st gen default of 9 minutes

Question 4

A team is developing a REST API on Cloud Run. They need to ensure that only authenticated requests from their corporate domain (example.com) are allowed. Which configuration should they use?

Accepted Answer

Set the Cloud Run service to require authentication and allow only the domain 'example.com' in the IAM policy. Cloud Run's IAM integration allows you to require authentication (via the `--no-allow-unauthenticated` flag) and then use IAM conditions to restrict access to principals from a specific domain (e.g., `request.auth.claims.email` ends with `@example.com`). This ensures only authenticated requests from the corporate domain are permitted, leveraging Google Cloud's identity-aware proxy (IAP) capabilities without additional infrastructure.

Answer

Implement custom authentication using Firestore to validate user tokens

Answer

Use Cloud Endpoints with an API key that is shared only with corporate users

Answer

Use Cloud Armor to deny traffic except from the corporate IP range

Question 5

Your team is building a Node.js application for Google App Engine Standard Environment. The application uses a custom runtime and must run background tasks. However, you notice that background tasks are being terminated after a few seconds. What is the most likely reason?

Accepted Answer

App Engine Standard Environment does not support background threads; use App Engine Flexible or Cloud Run instead. In Google App Engine Standard Environment, background threads are not supported because the runtime can terminate idle instances or scale down to zero, killing any background tasks. The correct solution is to use App Engine Flexible Environment or Cloud Run, which support long-running background processes, or to offload tasks to a service like Cloud Tasks or Cloud Pub/Sub. Option D correctly identifies this fundamental limitation of the Standard Environment.

Answer

The application should use Cloud Tasks instead of background threads

Answer

The application is not configured with max_concurrent_requests set to 1

Answer

You are using an automatic scaling instance class that does not support background threads

Question 6

You are building a data pipeline using Cloud Dataflow (Apache Beam). The pipeline reads from Pub/Sub, performs aggregations, and writes to BigQuery. Occasionally, you see duplicates in the BigQuery output, even though the pipeline uses .withInsertId() in the BigQuery write transform. What could be causing these duplicates?

Accepted Answer

The pipeline is using at-least-once mode and bundles are being retried, but the insertId is not being reused across retry attempts. Cloud Dataflow (Apache Beam) operates in at-least-once mode by default, meaning bundles may be retried during processing. When a bundle is retried, the insertId set via .withInsertId() must be reused across retry attempts to enable BigQuery's deduplication. If the insertId is not reused (e.g., because it's generated per attempt or not properly propagated), BigQuery treats each write as a separate row, resulting in duplicates.

Answer

You are not using the exactly-once sink option for BigQuery

Answer

You have set .withOutputParallelization() to false

Answer

You need to enable Dataflow's built-in deduplication using the .withIdAttribute() in Pub/Sub read

Question 7

A developer wants to store secrets (e.g., API keys) for use in Cloud Functions without exposing them in the source code. Which Google Cloud service should they use?

Accepted Answer

Use Secret Manager to store secrets and reference them via secret environment variables. Secret Manager is the dedicated Google Cloud service for storing sensitive data like API keys, passwords, and certificates. It provides built-in versioning, access control via IAM, and native integration with Cloud Functions through secret environment variables, ensuring secrets are never exposed in source code or configuration files.

Answer

Store secrets in a Cloud Storage bucket with encrypted objects and load them at runtime

Answer

Use Firestore to store secrets in a secure document and access it via the Firestore SDK

Answer

Use Cloud Key Management Service (Cloud KMS) to create and manage secrets

Question 8

You are designing a CI/CD pipeline for a microservices application deployed on GKE. Your team requires that each service have independent release cycles and canary deployments. Which combination of Google Cloud services should you use?

Accepted Answer

Cloud Source Repositories, Cloud Build, and Cloud Deploy with GKE target. Cloud Deploy provides native support for canary deployments and progressive delivery strategies to GKE targets, enabling independent release cycles per microservice. Cloud Source Repositories hosts the code, Cloud Build compiles and tests it, and Cloud Deploy manages the rollout with Skaffold-based pipelines, allowing fine-grained traffic splitting and automated promotion or rollback.

Answer

Cloud Source Repositories, Cloud Build, and App Engine

Answer

Cloud Source Repositories, Cloud Build, and Cloud Run

Answer

Cloud Source Repositories, Cloud Build, and Spinnaker

Question 9

Your team is using Cloud Build to build and test a Java application. The build includes unit tests, integration tests, and static code analysis. The build is failing intermittently due to flaky tests. You want to automatically retry the failed steps without rebuilding everything. Which Cloud Build feature should you use?

Accepted Answer

Set the 'allowFailure: false' and 'retry: 2' options on the test steps in the cloudbuild.yaml. Cloud Build supports the `retry` option on individual build steps, which allows a step to be automatically retried a specified number of times upon failure without re-executing previous steps. This is ideal for handling flaky tests, as it only reruns the failed step, preserving build artifacts and avoiding a full rebuild.

Answer

Configure a Cloud Build trigger to rerun the build on failure

Answer

Use build substitutions to pass different test parameters on failure

Answer

Increase the timeout for the build to allow retries

Question 10

A team wants to implement automated testing for a Python application deployed on Cloud Run. They want the tests to run as part of the CI/CD pipeline after the image is built but before it is deployed. Which approach should they use?

Accepted Answer

Add a test step in Cloud Build that uses the built image to run integration tests before deploying. Cloud Build allows you to add a test step that runs the built container image before deploying it to Cloud Run. This ensures integration tests validate the application in an environment identical to production, catching issues early in the CI/CD pipeline. Running tests after the image is built but before deployment is a standard practice for shift-left testing.

Answer

Use Cloud Function to run tests triggered by a Pub/Sub message after the image is published

Answer

Run unit tests before building the image using Cloud Build, but skip integration tests

Answer

Deploy the image to a staging environment, run tests, and then promote to production

Question 11

Which TWO statements are true about Cloud Functions? (Choose two.)

Accepted Answer

Cloud Functions automatically scale based on the number of incoming events. Cloud Functions automatically scale horizontally based on the number of incoming events, such as HTTP requests or Pub/Sub messages. The platform handles this scaling transparently, spinning up new function instances as needed to handle concurrent invocations, and scaling down to zero when idle. This is a key serverless characteristic that eliminates the need for manual capacity planning.

Answer

Cloud Functions require you to provide a container image from Container Registry

Answer

Cloud Functions can only be triggered by HTTP requests

Answer

Cloud Functions have a maximum execution timeout of 9 minutes for all runtimes

Question 12

Which THREE are best practices for building applications on GKE? (Choose three.)

Accepted Answer

Set resource requests and limits for CPU and memory. Setting resource requests and limits for CPU and memory is a best practice because it allows Kubernetes to make informed scheduling decisions and ensures that pods do not exceed their allocated resources, preventing resource starvation for other workloads. Requests guarantee a minimum amount of resources for the pod, while limits cap the maximum, enabling the cluster autoscaler and scheduler to optimize node utilization and maintain stability.

Answer

Use nodeSelector to pin pods to specific node instances for performance consistency

Answer

Use StatefulSets for all applications to preserve state across restarts

Question 13

Which TWO are benefits of using Cloud Build? (Choose two.)

Accepted Answer

It allows using custom build steps with community or private images. Cloud Build allows you to use custom build steps with community or private container images, enabling you to run arbitrary tools and scripts as part of your build pipeline. This flexibility means you are not limited to Google-provided build steps and can integrate any software that runs in a container.

Answer

It only supports Java and Go runtimes

Answer

It requires a trigger to start any build

Answer

It provides a source code repository for version control

Question 14

Refer to the exhibit. You have the above cloudbuild.yaml file. The build succeeds but the call to the function fails with a permission error. What is the most likely cause?

Accepted Answer

The function call is occurring before the deployment is fully complete, and the function is not yet ready to serve requests. The most likely cause is that the Cloud Build step deploys the function, but the subsequent test call occurs before the function's HTTP endpoint is fully provisioned and serving requests. Cloud Functions deployment is asynchronous; after the `gcloud functions deploy` command returns, the function may still be in a 'DEPLOYING' or 'ACTIVE' state but not yet ready to handle traffic. A permission error in this context typically arises because the function's IAM policy (e.g., `--allow-unauthenticated`) is applied only after the deployment completes, and the function's runtime endpoint may return a 403 until fully ready.

Answer

The function is using the wrong trigger type

Answer

The runtime 'nodejs16' is not supported

Answer

The '--allow-unauthenticated' flag is not allowed in Cloud Build

Question 15

Refer to the exhibit. A developer deployed a Cloud Run service with the above command. They notice that the service's latency is higher than expected under load. The service performs CPU-intensive tasks. What is the most likely reason for the high latency?

Accepted Answer

The execution environment is gen2, which only allocates CPU during request processing by default; the high concurrency causes CPU contention. Cloud Run's gen2 execution environment, by default, allocates CPU only during request processing. When concurrency is high, multiple requests compete for the same CPU quota, causing contention and increased latency for CPU-intensive tasks. The service's CPU-intensive nature exacerbates this issue, as the CPU is not continuously available between requests.

Answer

The service is using gen2, which does not support CPU-intensive workloads

Answer

The service should be deployed with --max-instances set to a lower number

Answer

The memory is insufficient for the concurrency level