PCD Building and testing applications Practice Test 7 — 15 Questions

Question 1

Refer to the exhibit. The Cloud Build fails with an error that the image name is invalid. What is the most likely cause?

Accepted Answer

The substitution variable $MY_PROJECT is not a valid substitution because it is not prefixed with underscore.. In Cloud Build, user-defined substitution variables must be prefixed with an underscore. The variable `$MY_PROJECT` lacks the required underscore prefix, making it invalid. This causes the image name to be malformed, leading to the 'invalid image name' error.

Answer

The push step should be after the deploy step.

Answer

The Docker build step fails because the Dockerfile is missing.

Answer

The image name contains uppercase letters that are not allowed.

Question 2

A team uses Cloud Build to deploy a containerized application to Cloud Run. The build step fails intermittently with the error 'Failed to trigger build: Build timed out'. What is the most likely cause?

Accepted Answer

The build exceeds the default Cloud Build timeout.. The error 'Failed to trigger build: Build timed out' indicates that the Cloud Build execution exceeded the maximum allowed duration. By default, Cloud Build has a timeout of 10 minutes for build steps. If the build process (e.g., pulling dependencies, building the container image) takes longer than this default timeout, the build is automatically terminated, resulting in this intermittent failure. Increasing the timeout in the build configuration or using a larger machine type can resolve this.

Answer

The build machine has insufficient memory.

Answer

The Dockerfile contains invalid syntax.

Answer

The Cloud Build service account lacks permissions to deploy to Cloud Run.

Question 3

A development team is implementing a CI/CD pipeline using Cloud Build. They need to ensure that sensitive data, such as API keys, are never exposed in build logs. What is the best practice?

Accepted Answer

Use Cloud Build's encrypted variables or Secret Manager to pass secrets at build time.. Cloud Build's encrypted variables and Secret Manager are designed to securely inject sensitive data like API keys at build time without exposing them in logs. Encrypted variables are stored in Cloud KMS and decrypted only during the build, while Secret Manager provides versioned secrets with fine-grained access control. This ensures secrets never appear in plaintext in the build configuration or output logs.

Answer

Store the API keys in a separate file in the source repository and reference it in the build.

Answer

Use custom substitutions with default values and rely on Cloud Build's encryption.

Answer

Store the API keys as plain text in cloudbuild.yaml and restrict access to the file.

Question 4

A company deploys a microservice on Google Kubernetes Engine (GKE) with a Cloud Deploy delivery pipeline. The application uses a custom container image stored in Artifact Registry. After a successful deployment to a staging cluster, the production deployment fails with 'ImagePullErr: image not found'. The staging and production clusters are in different projects. What is the most likely cause?

Accepted Answer

The production cluster's node pool has not been granted access to pull images from Artifact Registry in the staging project.. The production cluster's node pool, which runs in a different project, does not have the necessary permissions to pull the custom container image from Artifact Registry in the staging project. By default, GKE node pools use the Compute Engine default service account, which only has access to images in the same project. To pull images across projects, the node pool's service account must be granted the Artifact Registry Reader role (roles/artifactregistry.reader) on the repository in the staging project.

Answer

The Cloud Deploy service account lacks permission to create pods in the production cluster.

Answer

Cloud Deploy is not configured to use Artifact Registry and still references Container Registry.

Answer

The container image tag used in production is different from the staging tag.

Question 5

A developer is writing unit tests for a Python application that will run on Cloud Functions. The function makes HTTP requests to an external API. The developer wants to avoid making actual network calls during tests. What should the developer use?

Accepted Answer

Mock the HTTP requests using a library like unittest.mock.. `unittest.mock` allows the developer to replace the actual HTTP request calls (e.g., `requests.get`) with mock objects that return controlled responses, preventing any real network traffic. This is essential for unit testing Cloud Functions where external API calls must be isolated to ensure tests are fast, deterministic, and do not depend on external services.

Answer

Use a test double to replace the entire function.

Answer

Use dependency injection to pass a fallback URL.

Answer

Deploy the function to Cloud Functions and run integration tests.

Question 6

A team uses Cloud Build to build and deploy a Node.js application to App Engine flexible environment. The build succeeds, but the deployment fails with 'ERROR: (gcloud.app.deploy) Error Response: [9] Application startup error!' The team checks logs and sees 'Error: Module not found: 'express''. What is the most likely cause?

Accepted Answer

The dependencies are not installed during the build step before deploying.. The error 'Module not found: express' indicates that the Node.js dependencies (specifically the 'express' package) are not present in the deployed application. In Cloud Build, the build steps must explicitly install dependencies (e.g., via 'npm install') before the deploy step. If the build configuration does not include an 'npm install' step, the dependencies listed in package.json are not copied to the App Engine flexible environment, causing the startup error.

Answer

The build step includes 'npm test' which fails.

Answer

The Node.js version specified in app.yaml is incompatible with the dependencies.

Answer

The app.yaml file is missing from the root of the repository.

Question 7

A company is using Cloud Deploy to manage canary deployments to GKE. They want to automatically promote a release to the 'production' target if the canary deployment in the 'staging' target passes a set of automated smoke tests. What is the required configuration?

Accepted Answer

Define a deployment verifier in the pipeline that runs smoke tests and promotes on success.. Cloud Deploy supports deployment verifiers, which are custom Cloud Build jobs that run as part of a rollout. By defining a verifier in the pipeline that executes automated smoke tests, the canary deployment in the staging target can be automatically promoted to production only if the verifier succeeds. This integrates testing directly into the delivery pipeline without manual intervention.

Answer

Create a Cloud Build trigger to redeploy on test success.

Answer

Configure a manual approval gate between staging and production in the delivery pipeline.

Answer

Set the 'automaticPromotion' flag to true on the staging target.

Question 8

A developer is writing integration tests for a Cloud Function that uses Cloud Firestore. The tests must run in a local environment without incurring costs or affecting production data. What should the developer use?

Accepted Answer

Use the Firestore emulator running locally.. The Firestore emulator, part of the Firebase Local Emulator Suite, allows integration tests to run entirely on the local machine without network calls to GCP. This avoids incurring costs and prevents any impact on production data, as all operations are performed against an in-memory Firestore instance that mimics the real service's behavior.

Answer

Create a separate GCP project for testing and use its Firestore.

Answer

Mock the Firestore client library calls.

Answer

Run tests against the production Firestore instance with a test prefix.

Question 9

A team uses Cloud Build to build a Go application and deploy it to Cloud Run. The build triggers from a GitHub repository. The team wants to ensure that only commits to the 'main' branch trigger a production deployment, while other branches trigger a build but not a deployment. How should they configure this?

Accepted Answer

Use a single Cloud Build trigger with a substitution variable for the branch name, and include a conditional step that runs deployment only when the variable equals 'main'.. Cloud Build provides the predefined substitution variable $BRANCH_NAME, which automatically receives the branch name from the trigger event. By using a conditional step in cloudbuild.yaml that checks if $BRANCH_NAME equals 'main', you can run the deployment step only for main branch commits, while still building on all branches. This approach keeps a single trigger and avoids unnecessary duplication or external filtering.

Answer

Configure the GitHub repository to only send push events from the main branch to Cloud Build.

Answer

Use a conditional step in cloudbuild.yaml that checks the $_BRANCH variable and skips deployment if not main.

Answer

Create two separate Cloud Build triggers: one for main branch with deployment step, and one for all branches without deployment step.

Question 10

An organization uses Cloud Build to deploy multiple microservices to GKE. They want to ensure that the deployment process can be audited and that each deployment can be rolled back to a previous version. What is the recommended approach?

Accepted Answer

Use Cloud Deploy to manage deployments with rollback capabilities and audit logs.. Cloud Deploy is the recommended service for managing progressive deliveries and rollbacks on GKE, as it provides built-in rollback capabilities, audit logging, and delivery pipeline management. Unlike raw Kubernetes Deployment history, Cloud Deploy integrates with Cloud Build and offers a controlled, auditable deployment process with the ability to roll back to any previous release revision.

Answer

Use Kubernetes Deployment history to rollback by specifying a revision.

Answer

Store each manifest version in Artifact Registry and manually apply kubectl.

Answer

Use Cloud Build to redeploy a previous image tag when rollback is needed.

Question 11

Which TWO of the following are valid strategies for testing Cloud Functions locally before deployment?

Accepted Answer

Use the Cloud Functions emulator provided by gcloud beta emulators.. The `gcloud beta emulators` command includes a Cloud Functions emulator that allows you to run your functions locally in a simulated environment, enabling testing without deploying to the cloud. Option D is correct because the Functions Framework is an open-source library that starts a local HTTP server (typically on port 8080) and serves your function, matching the Cloud Functions runtime environment exactly.

Answer

Write unit tests that mock the HTTP request and response objects.

Answer

Use the Cloud Console to invoke the function with test events.

Answer

Deploy the function to a staging Cloud Functions project and test via HTTP invocations.

Question 12

Which THREE of the following are best practices for building secure applications on Google Cloud?

Accepted Answer

Use Secret Manager to manage sensitive configuration values.. Secret Manager provides a centralized and secure way to store and manage sensitive configuration values such as API keys, database passwords, and certificates. By using Secret Manager, you avoid hardcoding secrets in source code or configuration files, reducing the risk of exposure. It integrates with IAM for fine-grained access control and supports automatic rotation, ensuring that secrets are protected at rest and in transit.

Answer

Disable authentication on a test Cloud Run service for end-user testing.

Answer

Use a single service account for all Cloud Functions to simplify permissions.

Question 13

Which THREE of the following are valid reasons to use Cloud Deploy instead of manually applying kubectl commands in a CI/CD pipeline?

Accepted Answer

Cloud Deploy maintains a deployment history for auditing.. Cloud Deploy automatically maintains a detailed deployment history, including the state of each rollout, approvals, and metadata. This history is stored in the Cloud Deploy API and can be queried for auditing, compliance, and troubleshooting purposes, which is not natively provided by manual kubectl commands in a CI/CD pipeline.

Answer

Cloud Deploy automatically containerizes applications.

Answer

Cloud Deploy enforces IAM roles on Kubernetes clusters.

Question 14

You are a Cloud Developer at a fintech company. Your team has developed a Node.js application that processes real-time financial transactions. The application is deployed on Cloud Run and uses Cloud Pub/Sub to receive transaction messages. The application must have high availability and low latency. Recently, the team noticed that during peak hours, the application experiences increased latency and some messages are not processed within the required 10-minute SLA. The team has configured Cloud Run with a minimum of 5 instances and a maximum of 50, with a concurrency setting of 80. The CPU usage per instance rarely exceeds 40% during peak times. The team also uses Cloud Monitoring and Logging for observability. After analyzing the logs, you find that the message processing time increases due to a database call that often takes 2-3 seconds. The Pub/Sub subscription is configured with a delivery deadline of 10 minutes. What should you recommend to reduce latency and ensure messages are processed within SLA?

Accepted Answer

Increase the concurrency setting to 200 to allow each instance to handle more requests simultaneously, reducing queuing.. Increasing the concurrency setting to 200 allows each Cloud Run instance to handle more requests simultaneously, which reduces the queuing delay caused by the 2-3 second database call. Since CPU usage is only 40%, the instances have headroom to process additional concurrent requests without being CPU-bound, directly addressing the latency issue within the 10-minute SLA.

Answer

Migrate the application to GKE with Horizontal Pod Autoscaler to scale based on custom metrics.

Answer

Increase the CPU limit per container to 2 CPUs to speed up database call.

Answer

Increase the minimum number of instances to 50 to ensure capacity during peak hours.

Question 15

A company is building a microservice that processes incoming HTTP requests, performs some business logic, and writes results to Firestore. The service has variable traffic with occasional spikes. The development team wants to minimize cold start latency and prefers to use a containerized application with a custom runtime. Which compute option should they choose?

Accepted Answer

Cloud Run. Cloud Run is the correct choice because it runs containerized applications in a fully managed, serverless environment that automatically scales to zero and can handle variable traffic with occasional spikes. It minimizes cold start latency by keeping instances warm when traffic is expected, and it supports custom runtimes via Docker containers, meeting the team's requirement for a containerized application with a custom runtime.

Answer

Compute Engine

Answer

App Engine Standard

Answer

Cloud Functions (1st gen)