PCD Building and testing applications Practice Test 6 — 15 Questions

Question 1

Refer to the exhibit. You run the above command to build and push a Docker image to Container Registry. The build fails with an error: 'denied: Unauthenticated access'. What should you do to resolve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Grant the Cloud Build service account the Storage Object Admin role on the project. The error 'denied: Unauthenticated access' indicates that the Cloud Build service account does not have permission to push images to Container Registry. By default, Cloud Build uses the Cloud Build service account (service-[PROJECT_NUMBER]@cloudbuild.gserviceaccount.com) to execute builds. Granting the Storage Object Admin role (roles/storage.admin) to this service account provides the necessary permissions to write objects (Docker image layers) to the Container Registry bucket in Cloud Storage, resolving the authentication failure.

Answer

Grant the Cloud Build service account the Project Editor role

Answer

Grant the Compute Engine default service account the Storage Object Creator role

Answer

Run gcloud auth login as the project owner before submitting the build

Question 2

A company needs to build a CI/CD pipeline for a microservices architecture. They want to run unit tests quickly by only testing code that has changed. Which approach should they use?

Accepted Answer

Use Cloud Build with a step that checks `git diff` against the previous commit and runs tests only on affected modules using a test runner that supports file-based filtering.. It uses `git diff` to identify only the files that have changed and then runs tests on the affected modules, which is the most efficient approach for selective testing. Option A is not ideal because implementing a custom caching mechanism based on file hashes is complex and may not reliably skip tests when dependencies change. Option B runs all tests in parallel, but that does not reduce the test scope—it still runs the full test suite. Option C uses `git log`, which provides commit history rather than a direct diff of the current changes, making it less precise than `git diff` for identifying changed files.

Answer

Use Cloud Build with a step that caches test results based on file hashes.

Answer

Use Cloud Build with a step that runs all tests in parallel.

Answer

Use Cloud Build with a step that uses `git log` to find changed files and run tests.

Question 3

A team is deploying a microservices application on Cloud Run and needs to implement canary deployments with traffic splitting. They are using Cloud Deploy. What is the correct configuration to gradually shift traffic from the old revision to the new revision?

Accepted Answer

Use a Cloud Deploy delivery pipeline with a canary strategy that specifies percentages like [5, 10, 50, 100] and includes a verification step.. Cloud Deploy natively supports canary deployments with traffic splitting for Cloud Run. By defining a canary strategy with incremental percentages (e.g., [5, 10, 50, 100]) and including a verification step, the pipeline automatically shifts traffic in stages, pausing for verification at each phase to ensure the new revision is healthy before progressing. This approach integrates directly with Cloud Deploy's delivery pipeline, eliminating the need for manual scripts or external API calls.

Answer

Use Cloud Build to deploy with a script that gradually increases traffic using the Cloud Run API.

Answer

Use a Cloud Deploy pipeline with a blue-green strategy that swaps all traffic at once.

Answer

Use Cloud Run's built-in traffic splitting with `gcloud run deploy --traffic` and manage manually.

Question 4

A developer wants to run integration tests against a Cloud Spanner emulator in a local development environment. What is the best way to set up the emulator?

Accepted Answer

Run the Cloud Spanner emulator Docker container and set the SPANNER_EMULATOR_HOST environment variable.. The Cloud Spanner emulator is distributed as a Docker container, and the recommended way to run it locally is to start that container and set the `SPANNER_EMULATOR_HOST` environment variable (e.g., `localhost:9010`) so that the Spanner client library redirects all API calls to the emulator instead of the production service. This provides a fully functional, in-memory Spanner instance for integration testing without incurring costs or requiring network access to GCP.

Answer

Use a mock library instead of an emulator.

Answer

Use the Cloud Spanner API directly without an emulator.

Answer

Install the emulator using `gcloud emulators spanner start`.

Question 5

A company is using Cloud Build for CI and wants to store build artifacts in Artifact Registry. They want to ensure that only successful builds are promoted to production. What should they do?

Accepted Answer

Use Cloud Build steps that push to Artifact Registry only if all previous steps succeed by using `waitFor` and checking exit codes.. Cloud Build steps run sequentially and only if previous steps succeed by default, so pushing to Artifact Registry only if tests pass. Option A is not sufficient because builds on main can still fail. Option C involves manual intervention. Option D is incorrect as it ignores build status.

Answer

Use Cloud Build to deploy to a staging environment, then manually promote to production.

Answer

Use Cloud Build triggers with a condition that only builds on the main branch are deployed.

Answer

Use Cloud Build with a custom script that pushes regardless of build status.

Question 6

A developer is debugging a Cloud Function that fails with a timeout. The function makes multiple synchronous external API calls. What is the best way to improve performance and avoid timeouts?

Accepted Answer

Use Cloud Tasks to offload the API calls asynchronously.. Cloud Tasks is the best choice because it allows you to offload synchronous external API calls to be executed asynchronously, decoupling the Cloud Function from the slow external services. This prevents the function from timing out while waiting for responses, and Cloud Tasks handles retries and scheduling automatically, improving overall reliability and performance.

Answer

Increase the timeout of the Cloud Function to the maximum of 9 minutes.

Answer

Use Firestore transactions to batch API calls.

Answer

Use Pub/Sub to trigger another function for each API call.

Question 7

A developer wants to containerize a Node.js application and deploy it to Cloud Run. They need to ensure the container is as small as possible. What should they do?

Accepted Answer

Use a multi-stage Dockerfile with a distroless base image.. A multi-stage Dockerfile allows you to separate the build environment from the runtime environment. By using a distroless base image (e.g., gcr.io/distroless/nodejs), you include only the application and its runtime dependencies, omitting package managers, shells, and other OS utilities. This results in a significantly smaller container image, which reduces attack surface and improves deployment speed on Cloud Run.

Answer

Use a full Ubuntu base image with all dependencies.

Answer

Use a node:latest image and remove unnecessary files.

Answer

Use a simple FROM scratch image.

Question 8

A team is using Cloud Source Repositories and wants to enforce code reviews before merging. What tool should they use?

Accepted Answer

Cloud Source Repositories with branch protection rules that require pull request reviews and passing status checks.. Cloud Source Repositories (CSR) integrates with Cloud Build and Git. To enforce mandatory code reviews before merging, you configure branch protection rules on the CSR repository. These rules require pull request reviews and passing status checks (e.g., from Cloud Build), preventing direct pushes to protected branches. This is the native Git-based mechanism for enforcing review workflows.

Answer

Cloud Source Repositories pull requests without restrictions.

Answer

Cloud Deploy with manual approval.

Answer

Cloud Build triggers with approval gates.

Question 9

A developer is writing unit tests for a Python Cloud Run service that uses Cloud Firestore. They want to avoid hitting the real Firestore during tests. What should they use?

Accepted Answer

Mock the Firestore client using a library like unittest.mock.. Unit tests should isolate the code under test from external dependencies. Using `unittest.mock` to mock the Firestore client allows the developer to simulate Firestore calls and return controlled responses without any network I/O, ensuring tests are fast, deterministic, and independent of the real Firestore service.

Answer

Use a real Firestore database but with a test project.

Answer

Disable network access during tests.

Answer

Use the Firestore emulator for unit tests.

Question 10

A developer wants to run a single test suite across multiple environments (dev, staging, prod) using Cloud Build. What is the best practice?

Accepted Answer

Use a single Cloud Build trigger with substitutions to parameterize the environment.. Cloud Build triggers support substitutions (e.g., `$_ENV`) that allow a single trigger to parameterize the environment variable, enabling the same test suite to run across dev, staging, and prod without duplicating configuration. This aligns with Infrastructure as Code (IaC) principles and reduces maintenance overhead.

Answer

Use Cloud Deploy to run tests in each environment.

Answer

Use separate branches for each environment.

Answer

Create separate Cloud Build triggers for each environment.

Question 11

Which TWO are best practices for testing containerized applications on Google Cloud?

Accepted Answer

Use Cloud Build to build and test containers.. Cloud Build is a managed CI/CD platform that can build container images from source code and execute tests as part of the build pipeline. It integrates natively with Google Cloud services like Container Registry and Artifact Registry, and supports custom build steps, making it an ideal tool for building and testing containerized applications in a consistent, automated environment.

Answer

Use Kubernetes for testing only.

Answer

Use Distroless images for testing.

Answer

Use a different base image for testing than production.

Question 12

Which THREE are valid approaches for automating testing in a Cloud Build CI pipeline?

Accepted Answer

Use Cloud Build triggers to run tests on every push to a branch.. Cloud Build triggers can be configured to automatically start a build (including test steps) on specific events, such as a push to a branch. This enables continuous integration by validating every code change as soon as it is committed, without manual intervention.

Answer

Use Cloud Build to ship test results to Cloud Monitoring.

Answer

Use Cloud Build to run tests only after manual approval.

Question 13

Which TWO are benefits of using Cloud Build for your CI/CD pipeline?

Accepted Answer

Built-in integration with Cloud Source Repositories, GitHub, and Bitbucket.. Cloud Build natively integrates with Cloud Source Repositories, GitHub, and Bitbucket, allowing you to automatically trigger builds on code commits without additional configuration. This tight integration streamlines the CI/CD pipeline by eliminating the need for external webhook management or custom connectors.

Answer

Provides unlimited free build minutes per day.

Answer

Supports only Java and Python.

Answer

Requires manual setup for all test runners.

Question 14

Refer to the exhibit. The developer receives an error when creating the delivery pipeline. What is the most likely cause?

Accepted Answer

The canary percentages for the prod target do not sum to 100.. In a canary deployment pipeline, the percentages assigned to the canary and primary stages must sum to 100% to represent the full traffic split. If they do not sum to 100, the pipeline fails as the deployment service cannot determine how to route the remaining traffic, causing the error.

Answer

The prod target is missing a verification step.

Answer

The dev target has four percentages, but only two are allowed.

Answer

The pipeline name is too long.

Question 15

Refer to the exhibit. The function returns 'Error' even though the document exists. What is the most likely reason?

Accepted Answer

The document ID in the query parameter is URL-encoded and needs to be decoded using `decodeURIComponent`.. The most likely reason is that the document ID in the query parameter is URL-encoded, and the function does not decode it before using it as a Firestore document reference. Firestore document IDs are case-sensitive and must match exactly; a URL-encoded string like 'doc%20name' will not match the actual document 'doc name', causing the update to fail and return 'Error'. Using `decodeURIComponent` on the parameter before passing it to Firestore resolves this.

Answer

The function has insufficient IAM permissions for Firestore.

Answer

The Firestore emulator is not running.

Answer

The `update` method requires that the document exists.