PCD Building and testing applications Practice Test 6 — 15 Questions

Question 1

A developer is using Cloud Build to build a container image and wants to ensure that the build fails if any unit tests fail. The tests are run using a custom build step that executes 'npm test'. Which configuration should they add to the cloudbuild.yaml file?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a build step with the 'npm test' command and ensure it is placed before the Docker build step.. Cloud Build steps run sequentially by default, and the build fails immediately if any step returns a non-zero exit code. Therefore, placing the test step before the Docker build step ensures that tests must pass before the image is built. No special fields like 'allowFailure' are needed. The other options either reference invalid fields or incorrectly use parallel execution, which would not prevent building an image from failing code.

Answer

Add a build step with the 'npm test' command and set 'id: test' and then in the Docker build step add 'waitFor: ['test']'.

Answer

Add a build step with the 'npm test' command and set 'waitFor: ['-']' to run it in parallel with the Docker build step.

Answer

Add a build step with the 'npm test' command and set 'allowFailure: false'.

Question 2

A developer is deploying a Cloud Run service that connects to Cloud SQL. They want to run integration tests locally that mimic the production environment as closely as possible, including the database connection. Which two actions should they take? (Choose two.)

Accepted Answer

Use the Cloud SQL Proxy to connect to a Cloud SQL instance from the local environment.. To mimic production when testing locally, developers should use the Cloud SQL Proxy to establish a secure connection to the Cloud SQL instance, and set the CLOUD_SQL_CONNECTION_NAME environment variable so the application knows which instance to connect to. These two actions replicate the connection method used in Cloud Run, where the proxy is often used and the connection name is provided via environment variable. Other options either involve non-existent emulators or do not achieve local testing.

Answer

Run the Cloud SQL emulator locally and configure the service to connect to it.

Answer

Deploy the service to Cloud Run and run tests against the deployed version.

Answer

Use the Cloud SQL Auth Proxy in a sidecar container alongside the local service.

Question 3

A developer is building a Cloud Run service that reads messages from a Pub/Sub subscription. During integration testing, the service must run locally and consume messages from a Pub/Sub emulator. The developer has already started the emulator on localhost:8085 and set the PUBSUB_EMULATOR_HOST environment variable. When running the service locally, the Pub/Sub client library fails to connect to the emulator and instead attempts to reach the production Pub/Sub API. What should the developer do to ensure the client library uses the emulator?

Accepted Answer

Ensure the Pub/Sub client library is initialized after the PUBSUB_EMULATOR_HOST environment variable is set in the running process.. The Pub/Sub client library checks the PUBSUB_EMULATOR_HOST environment variable when the client is created. If the variable is set in the shell but the application process does not see it (for example, because it was set after the process started or not exported), the client will connect to the production API. Ensuring the variable is present in the environment before the client library initializes resolves the issue.

Answer

Create the Pub/Sub client using the emulator endpoint by passing the apiEndpoint option to the client constructor.

Answer

Configure the Pub/Sub client to use a custom HTTP transport that points to localhost:8085.

Answer

Set the GOOGLE_APPLICATION_CREDENTIALS environment variable to a service account key file with Pub/Sub permissions.

Question 4

A developer is building a Cloud Run service that connects to Cloud SQL for PostgreSQL. During local development, the developer wants to run the service in a container and connect to a local PostgreSQL instance. The service uses the Cloud SQL Auth Proxy to connect to Cloud SQL in production. Which two actions should the developer take to enable the service to connect to the local PostgreSQL instance without modifying the application code? (Choose two.)

Accepted Answer

Set the DB_HOST environment variable to the hostname of the local PostgreSQL container or host machine.. To connect to a local PostgreSQL instance without changing application code, the developer should configure the service to use the local database's host and port via environment variables. The application likely reads DB_HOST and DB_PORT, so setting these to the local instance's address and port enables connectivity. This approach maintains code consistency between local and production environments, where the Cloud SQL Auth Proxy handles connections.

Answer

Run the Cloud SQL Auth Proxy locally with the -instances flag pointing to the production Cloud SQL instance, and configure the application to connect to the proxy's local port.

Answer

Configure the application to use the Cloud SQL Auth Proxy by setting the INSTANCE_CONNECTION_NAME environment variable to the local PostgreSQL instance.

Answer

Mount the local PostgreSQL socket file into the Cloud Run service container and update the application to use the Unix socket.

Question 5

A developer is using Cloud Build to run unit tests for a Node.js application. The build steps include installing dependencies, running tests, and building a Docker image. The unit tests require a Redis instance for caching. To keep the build fast and self-contained, the developer wants to run a Redis container alongside the build steps. Which Cloud Build configuration should the developer use?

Accepted Answer

Use a single build step that starts Redis, waits for it to be ready, runs the tests, and then stops Redis.. To run Redis alongside tests in Cloud Build without cross-step networking issues, the developer should start Redis within the same build step that runs the tests. This ensures Redis is available on localhost and does not require Docker-in-Docker or custom networking. It keeps the build self-contained and fast, as the Redis instance is ephemeral and tied to the test step.

Answer

Configure the build to use a custom worker pool with a Redis instance installed on the host machine.

Answer

Add a build step that runs the Redis container in the background using the 'docker run -d redis' command.

Answer

Define a second container in the build using the 'services' field to run Redis, and reference it by hostname in the test step.

Question 6

A developer is writing a Cloud Function in Python that is triggered by HTTP. The function must validate incoming JSON payloads against a schema and return a 400 error if validation fails. The developer wants to write unit tests that invoke the function with various payloads and assert the responses. Which testing approach should the developer use?

Accepted Answer

Use the functions-framework package to run the function locally and send HTTP requests to it using a test client.. The functions-framework package is the official way to run Cloud Functions locally. It allows developers to test HTTP-triggered functions by sending real HTTP requests to a local server, which accurately mimics production behavior. This enables testing of request parsing, validation logic, and response formatting, including status codes. It is the recommended approach for unit testing Cloud Functions in Python.

Answer

Use the Cloud Functions emulator provided by the Google Cloud SDK to start a local emulator and send HTTP requests to it.

Answer

Import the function's source code and call the function directly with a mock request object, asserting on the returned response.

Answer

Deploy the function to a test environment and use curl to send requests, then check the logs for validation errors.

Question 7

A company is developing a microservices application on Google Cloud. Each service is deployed as a Docker container on Cloud Run. The development team wants to ensure that inter-service communication is encrypted and authenticated. What is the best approach?

Accepted Answer

Use Cloud Run's built-in IAM-based authentication and automatic TLS for internal requests.. Cloud Run automatically provisions TLS certificates for all incoming requests and supports IAM-based authentication for internal requests between services in the same Google Cloud project. This means inter-service communication is encrypted by default via HTTPS and can be authenticated by configuring the receiving service to require a valid IAM token from the caller, without any additional infrastructure or sidecar proxies.

Answer

Configure mutual TLS (mTLS) between services using Cloud Endpoints.

Answer

Deploy a sidecar proxy on each Cloud Run service to handle TLS termination.

Answer

Assign a service account to each service and use its private key to sign requests.

Question 8

A developer needs to test a Cloud Function locally before deploying. Which tool should they use?

Accepted Answer

Functions Framework for your language.. The Functions Framework is the correct tool because it is an open-source library that allows you to run Cloud Functions locally on your machine, emulating the Cloud Functions runtime environment. This enables you to test your function's behavior, including HTTP triggers and event handling, without deploying to Google Cloud. Option D is correct because the Functions Framework is specifically designed for local development and testing of Cloud Functions.

Answer

Docker container with a custom entrypoint.

Answer

gcloud functions call command.

Answer

Cloud Code for VS Code or IntelliJ.

Question 9

A company is migrating a monolithic Java application to microservices on Google Kubernetes Engine (GKE). The application uses a shared MySQL database. The team wants to adopt a testing strategy that validates service interactions without deploying to a full cluster. Which testing approach is most appropriate?

Accepted Answer

Consumer-driven contract testing with tools like Spring Cloud Contract.. Consumer-driven contract testing (CDC) with tools like Spring Cloud Contract validates the interactions between microservices by defining and verifying API contracts (e.g., request/response formats, headers, status codes) without requiring a full GKE cluster. This approach is ideal for a migration from a monolithic Java application because it ensures that each service adheres to its expected behavior when communicating over HTTP or messaging, catching integration issues early in the development cycle. It does not require deploying to a cluster, making it faster and more lightweight than end-to-end testing.

Answer

Load testing to simulate production traffic.

Answer

Unit testing with mocked dependencies.

Answer

End-to-end testing in a staging environment.

Question 10

Which THREE steps are required to set up a CI/CD pipeline for Cloud Run using Cloud Build and GitHub? (Choose THREE.)

Accepted Answer

Enable the Cloud Build, Cloud Run, and Artifact Registry APIs.. Option A is correct because the pipeline depends on the Cloud Build, Cloud Run, and Artifact Registry services, so their APIs must be enabled in the project before builds, image storage, and deployments can occur. Option B is correct because Cloud Build executes under its own service account, which needs the Cloud Run Developer (roles/run.developer) role (plus actAs on the runtime service account) to deploy the built image to Cloud Run. Option C is correct because Cloud Build requires a build configuration, and placing a cloudbuild.yaml at the repository root defines the build, push, and deploy steps that Cloud Build executes for the GitHub-triggered pipeline. Option D is not required because Container Registry is the legacy registry; the modern pipeline pushes to Artifact Registry, and the push step is defined inside cloudbuild.yaml rather than being a separate setup step. Option E is not required because Cloud Build connects directly to GitHub repositories via the Cloud Build GitHub App or triggers, so mirroring to Cloud Source Repositories is unnecessary.

Answer

Push the container image to Container Registry.

Answer

Mirror the GitHub repository to Cloud Source Repositories.

Question 11

A developer needs to build a CI/CD pipeline that automatically tests and deploys a Node.js application to Cloud Run whenever a pull request is merged to the main branch. Which Google Cloud service should be used to trigger the pipeline?

Accepted Answer

Cloud Build. Cloud Build is the correct service because it is Google Cloud's fully managed CI/CD platform that can automatically trigger pipeline executions in response to repository events, such as a pull request merge to the main branch. By configuring a Cloud Build trigger with a source repository (e.g., Cloud Source Repositories, GitHub, or Bitbucket), the developer can define build steps to test the Node.js application and deploy it to Cloud Run using the `gcloud run deploy` command or a dedicated builder. This makes Cloud Build the native and most direct choice for building, testing, and deploying to Cloud Run in a single automated pipeline.

Answer

Cloud Functions

Answer

Cloud Deploy

Answer

App Engine

Question 12

A company deploys a Java application on Compute Engine with a preemptible VM instance group managed by an instance template. The application writes critical state to local SSD. After a preemption event, the new instance starts fresh and loses state. What is the best practice to ensure state persistence?

Accepted Answer

Refactor the application to write state to a persistent service like Cloud Storage. Local SSD data is ephemeral and lost on VM preemption or termination. Refactoring the application to write critical state to a persistent service like Cloud Storage ensures data durability independent of the VM lifecycle. This aligns with the best practice of designing preemptible workloads to be stateless, where state is stored externally.

Answer

Modify the startup script to recover state from a snapshot

Answer

Configure the managed instance group as stateful to preserve local SSD data

Answer

Use a regular (non-preemptible) VM instead of preemptible

Question 13

During a code review, a developer notices that the application's Cloud Storage client library is using the default credentials of the Compute Engine instance. What is a more secure alternative for a production environment?

Accepted Answer

Create a dedicated service account with minimal permissions and attach it to the instance. Creating a dedicated service account with minimal permissions and attaching it to the Compute Engine instance follows the principle of least privilege. This avoids using the overly permissive default Compute Engine service account, which often has broad access to many Google Cloud services. By scoping the service account to only the required Cloud Storage permissions (e.g., roles/storage.objectViewer), you reduce the attack surface and adhere to production security best practices.

Answer

Store user credentials in a configuration file

Answer

Use an API key for Cloud Storage

Answer

Generate an access token and embed it in the code

Question 14

A team is migrating a monolithic .NET application to Cloud Run. The application uses .NET Framework 4.8 and depends on Windows-specific libraries. What is the recommended approach to containerize and deploy this application?

Accepted Answer

Port the application to .NET Core/.NET 6+ and run on Linux. Cloud Run only supports Linux containers, so a .NET Framework 4.8 application that depends on Windows-specific libraries cannot be directly deployed. The recommended approach is to port the application to .NET Core/.NET 6+ (now .NET 8/9), which is cross-platform and can run on Linux containers, enabling deployment to Cloud Run. This aligns with Google's guidance for modernizing legacy .NET applications to leverage serverless platforms.

Answer

Deploy the application on Compute Engine with Windows Server

Answer

Use Cloud Run for Anthos on a Windows node pool

Answer

Use a Windows base image and deploy to Cloud Run

Question 15

Refer to the exhibit. A developer deployed a Cloud Run service as shown. Authenticated requests from another service in the same project using a service account receive 403 Forbidden. What is the most likely cause?

Accepted Answer

The service account used to authenticate is not granted the roles/run.invoker role on the Cloud Run service. The Cloud Run service requires the IAM role `roles/run.invoker` on the service itself for any principal (including a service account) to invoke it. Since the service was deployed with `--no-allow-unauthenticated`, only explicitly granted principals can invoke it. The service account used for authentication lacks this role, causing the 403 Forbidden response.

Answer

The Cloud Run service requires the 'allAuthenticatedUsers' member to be added

Answer

The --no-allow-unauthenticated flag blocks all requests including authenticated ones

Answer

The container image was built without proper authentication headers